How Cookie works
All matching cookies go in one header, separated by ; , with only names and values; attributes like Expires are never sent back. Every request to the domain carries them, including image and script requests, so large cookies slow down the whole site. Keep them small and scope them with Path or a separate domain for static files.
Examples
Cookie: session=4f2a9c; theme=darkCommon mistakes
- Servers commonly limit total header size to 8–16 KB; too many or too large cookies cause 400 or 431 errors that only affect some users.
Check it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Set-Cookie: stores a cookie in the browser, with attributes that control its lifetime, scope and security.
- Authorization: carries the client’s credentials: a bearer token, Basic username and password, or another scheme.
- Origin: tells the server which origin (scheme, host and port) a request comes from.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Cookie header do?
The Cookie request header sends the browser’s stored cookies for this site back to the server. All matching cookies go in one header, separated by ; , with only names and values; attributes like Expires are never sent back. Every request to the domain carries them, including image and script requests, so large cookies slow down the whole site. Keep them small and scope them with Path or a separate domain for static files.
How do I see the Cookie header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".