diff --git a/README.md b/README.md
index d844900..b90ea81 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,13 @@ this serves a nginx server on port 8443
 127.0.0.1 website.com a.website.com b.website.com sub.a.website.com
 ```
 
+to add attributes, modify the file `cookieattr`
+```
+# cookieattr
+set $cookie_attr 'Secure; Domain=a.host.com; HttpOnly;';
+```
+note that the `;` at the end is the line terminator for nginx config and is necessary
+
 next, install `just` for your system. take a look at <https://just.systems> if unsure how
 
 get `podman` too while you're at it. you don't have `openssl`? what insane operating system are you on? get openssl too.
diff --git a/conf.d/cookieattr.part b/conf.d/cookieattr.part
new file mode 100644
index 0000000..6360e02
--- /dev/null
+++ b/conf.d/cookieattr.part
@@ -0,0 +1 @@
+set $cookie_attr 'Secure;';
diff --git a/conf.d/server.conf b/conf.d/server.conf
index bd494f6..bd374a9 100644
--- a/conf.d/server.conf
+++ b/conf.d/server.conf
@@ -9,6 +9,8 @@ server {
 	ssl_certificate_key /etc/nginx/ssl/key.pem;
 	server_name a.website.com b.website.com sub.a.website.com;
 
+	include 'conf.d/cookieattr.part';
+
 	root /srv/www;
 
 	try_files $uri $uri.html /index.html =200;
@@ -20,7 +22,7 @@ server {
 	}
 	location /set {
 		try_files $uri $uri.html /index.html =200;
-		add_header set-cookie 'flavour=$flavour; max-age=3600;';
+		add_header set-cookie 'flavour=$flavour; $cookie_attr';
 	}
 	location /clear {
 		try_files $uri $uri.html /index.html =200;
diff --git a/cookieattr b/cookieattr
new file mode 120000
index 0000000..07a385b
--- /dev/null
+++ b/cookieattr
@@ -0,0 +1 @@
+conf.d/cookieattr.part
\ No newline at end of file