Cookie
request headerauthentication & cookies
Sends the cookies the browser has stored for this site back to the server.
When a request matches a stored cookie's domain, path and SameSite rules, the browser adds it to the Cookie header as name=value pairs separated by semicolons. The attributes from Set-Cookie are not sent back — only names and values.
Syntax
Cookie: <name>=<value>; <name>=<value>…
Defined in RFC 6265 §5.4 — The Cookie Header.
Examples
Cookie: session=abc123; theme=dark
two cookies
Good to know
- Every cookie for a domain rides on every matching request — images, scripts and API calls included. Keep them few and small.
- Servers usually reject request headers over 8–16 KB; a 431 often means oversized cookies.
- Cross-origin fetch only includes cookies with
credentials: "include".
Further reading: SameSite cookies explained
Who sets Cookie
Browsers build the Cookie header from stored cookies; you control it by setting cookies with Set-Cookie (or document.cookie for non-HttpOnly ones). From curl, send one explicitly: curl -H "Cookie: session=abc123" https://example.com/ — or use -b.
Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
Why does a cookie show in DevTools but not reach my API?
Check the cookie's Domain and Path against the API URL, its SameSite value if the API is on another site, and that the request uses credentials: 'include' when it's cross-origin.