--- title: Hono: middleware, cookies, headers, redirects | daily.dev description: A practical guide to using Hono's middleware, headers, cookies, and redirects for real-world web apps. Covers built-in middleware (logger, basic auth, CORS),... canonical: https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hono: middleware, cookies, headers, redirects | daily.dev og:description: A practical guide to using Hono's middleware, headers, cookies, and redirects for real-world web apps. Covers built-in middleware (logger, basic auth, CORS),... og:url: https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike og:image: https://api.daily.dev/og/posts/ijXNCvIKe.png og:image:alt: Hono: middleware, cookies, headers, redirects og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hono: middleware, cookies, headers, redirects **[Flavio Copes](https://daily.dev/sources/flaviocopes)** · 4 min read · 0 upvotes · 0 comments ## Summary A practical guide to using Hono's middleware, headers, cookies, and redirects for real-world web apps. Covers built-in middleware (logger, basic auth, CORS), writing custom middleware with the async context/next pattern, reading and setting HTTP headers, managing cookies with httpOnly/secure/sameSite options, signed cookies for sensitive data, and using c.redirect() with 302 and 301 status codes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I set a signed cookie in Hono to prevent client-side tampering? Use setSignedCookie(c, name, value, secret) from hono/cookie, which works like the regular cookie helper but adds a cryptographic signature to the value. Retrieve it with getSignedCookie(c, secret, name); if someone modifies the cookie value in the browser, the signature check fails and the value can be rejected, making signed cookies suitable for sensitive session data. _daily.dev surfaces practical session security patterns for developers securing cookie-based auth._ ### What is the difference between a 301 and 302 redirect in Hono using c.redirect()? c.redirect('/there') defaults to a 302 temporary redirect, while passing 301 as a second argument, c.redirect('/there', 301), issues a permanent redirect. Use 302 for cases where the destination might change, such as login flows or temporary moves, and 301 when the old URL is gone for good and search engines should update their index. _Developers wiring up navigation logic can track redirect behavior details like these via daily.dev._ ## Similar posts on daily.dev - [Hono: a modern web framework for JavaScript](https://daily.dev/posts/hono-a-modern-web-framework-for-javascript-ndollhpgn) · Flavio Copes · 3 upvotes · 1 comments - [What is hono? The edge-native web framework explained \(2026\)](https://daily.dev/posts/what-is-hono-the-edge-native-web-framework-explained-2026--dqqzaspve) · FireUp · 42 upvotes · 5 comments - [The Rise of Micro-Backends: Why Frontend Devs Love Hono](https://daily.dev/posts/the-rise-of-micro-backends-why-frontend-devs-love-hono-a9wal9hdp) · SitePoint · 0 upvotes · 0 comments - [Adding Auth0 to Hono on Cloudflare Workers: A Practical Guide](https://daily.dev/posts/adding-auth0-to-hono-on-cloudflare-workers-a-practical-guide-noshswtx5) · Auth0 · 20 upvotes · 2 comments - [A deep dive into Hono](https://daily.dev/posts/a-deep-dive-into-hono-qm1c5p6li) · Flavio Copes · 2 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#bun](https://daily.dev/tags/bun) [View this post on daily.dev](https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hono: middleware, cookies, headers, redirects","url":"https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike"},"datePublished":"2026-08-09T06:05:13.639Z","dateModified":"2026-09-14T06:05:14.438Z","description":"A practical guide to using Hono's middleware, headers, cookies, and redirects for real-world web apps. Covers built-in middleware (logger, basic auth, CORS),...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7219243bb6b6113ecc90bd933965a4ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7219243bb6b6113ecc90bd933965a4ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flavio Copes","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flavio Copes","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1f2dbd275797411bbd37bfdaaf0951a9","url":"https://daily.dev/sources/flaviocopes"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,bun","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flavio Copes","item":"https://daily.dev/sources/flaviocopes"},{"@type":"ListItem","position":3,"name":"Hono: middleware, cookies, headers, redirects"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hono-middleware-cookies-headers-redirects-ijxncvike#faq","mainEntity":[{"@type":"Question","name":"How do I set a signed cookie in Hono to prevent client-side tampering?","acceptedAnswer":{"@type":"Answer","text":"Use setSignedCookie(c, name, value, secret) from hono/cookie, which works like the regular cookie helper but adds a cryptographic signature to the value. Retrieve it with getSignedCookie(c, secret, name); if someone modifies the cookie value in the browser, the signature check fails and the value can be rejected, making signed cookies suitable for sensitive session data. daily.dev surfaces practical session security patterns for developers securing cookie-based auth."}},{"@type":"Question","name":"What is the difference between a 301 and 302 redirect in Hono using c.redirect()?","acceptedAnswer":{"@type":"Answer","text":"c.redirect('/there') defaults to a 302 temporary redirect, while passing 301 as a second argument, c.redirect('/there', 301), issues a permanent redirect. Use 302 for cases where the destination might change, such as login flows or temporary moves, and 301 when the old URL is gone for good and search engines should update their index. Developers wiring up navigation logic can track redirect behavior details like these via daily.dev."}}]} ```