Cookies

Code

# Set-Cookie response
HTTP/1.1 200 OK
Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Strict
Set-Cookie: theme=dark; Max-Age=86400; Domain=.example.com

---

# Cookie request header
GET /dashboard HTTP/1.1
Host: example.com
Cookie: session=abc123; theme=dark

---

# Deleting a cookie (expire in the past)
HTTP/1.1 200 OK
Set-Cookie: session=; Expires=Thu, 01 Jan 1970 00:00:00 GMT

Explanation

The server sets cookies via Set-Cookie headers, and the browser returns them as a single Cookie header on subsequent requests. Attributes like HttpOnly, Secure, and SameSite harden cookies against XSS and CSRF. To delete a cookie, the server re-issues it with an Expires date in the past.

More HTTP Snippets