# Cookie Header — Syntax, Values & Examples

> Sends the cookies the browser has stored for this site back to the server.

When a request matches a stored cookie's domain, path and SameSite rules, the browser adds it to the Cookie header as `name=value` pairs separated by semicolons. The attributes from Set-Cookie are not sent back — only names and values.

- Type: Request header
- Category: Authentication & cookies
- Defined in: [RFC 6265 §5.4 — The Cookie Header](https://www.rfc-editor.org/rfc/rfc6265.html#section-5.4)

## Syntax

```http
Cookie: <name>=<value>; <name>=<value>…
```

## Examples

```http
Cookie: session=abc123; theme=dark
```

two cookies

## Good to know

- Every cookie for a domain rides on every matching request — images, scripts and API calls included. Keep them few and small.
- Servers usually reject request headers over 8–16 KB; a [431](https://www.devkult.com/http/431.md) often means oversized cookies.
- Cross-origin fetch only includes cookies with `credentials: "include"`.

## Who sets Cookie

Browsers build the Cookie header from stored cookies; you control it by setting cookies with `Set-Cookie` (or `document.cookie` for non-HttpOnly ones). From curl, send one explicitly: `curl -H "Cookie: session=abc123" https://example.com/` — or use `-b`.

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### Why does a cookie show in DevTools but not reach my API?

Check the cookie's Domain and Path against the API URL, its SameSite value if the API is on another site, and that the request uses credentials: 'include' when it's cross-origin.

## Status codes it appears with

- [431 Request Header Fields Too Large](https://www.devkult.com/http/431.md)

## Related headers

- [Set-Cookie](https://www.devkult.com/headers/set-cookie.md): Stores a cookie in the browser, with attributes that control its lifetime, scope and security.
- [Access-Control-Allow-Credentials](https://www.devkult.com/headers/access-control-allow-credentials.md): Allows a cross-origin page to read a response to a request made with cookies or HTTP authentication.
- [Authorization](https://www.devkult.com/headers/authorization.md): Carries the client's credentials — a bearer token, Basic username and password, or another scheme.

## Further reading

- [SameSite cookies explained](https://www.devkult.com/blog/samesite-cookies-explained.md)

Open the interactive page: https://www.devkult.com/headers/cookie