HTTP headers · Request
Cookie
Cookie sends stored name-value pairs from the client back to the server.
Key facts
| Type | Request |
|---|---|
| Syntax | <code>session=abc; theme=dark</code> |
| Separator | Semicolon between pairs |
| Attributes | None; they belong to Set-Cookie |
| Scope | Domain, path and Secure rules |
| Size | Roughly 4 KB per cookie |
| Standard | RFC 6265 |
What the browser sends
Cookies are set by the server with Set-Cookie and returned automatically when the request matches their domain, path and security attributes. The Cookie header contains only names and values; the attributes that governed storage are not echoed back.
Because the browser attaches cookies automatically, any request to the matching origin carries them, including image loads and third-party embeds. That automatic behaviour is why cross-site request forgery exists and why SameSite matters.
Size, scope and privacy
Browsers limit both the number and size of cookies; roughly 4 KB per cookie is the practical ceiling. Large state belongs in server-side storage with a small identifier in the cookie. Sending every cookie on every request also costs bandwidth on asset-heavy pages.
Cookies are not a secure storage area. They are readable by any script on the page unless marked HttpOnly. Sensitive values should be opaque identifiers, not user data or permissions encoded in plain text.
Frequently asked questions
Why do I see multiple cookies in one header?
HTTP/2 and HTTP/1.1 can combine them into one Cookie header. The semicolon is the separator, and order is not significant.
Can JavaScript read HttpOnly cookies?
No. HttpOnly removes the cookie from document.cookie, which limits damage from cross-site scripting but does not prevent the request from carrying it.