Cookies over HTTP
Follow the cookie round trip
Trace Set-Cookie from a response into the browser cookie jar and back through matching Cookie request headers.
8 minute lesson
A cookie connects browser storage to HTTP. That is its defining feature.
A server creates or updates a cookie with the Set-Cookie response header. The browser stores it, checks its scope on later requests, and adds matching values to the Cookie request header. Frontend code does not set that request header manually.
HTTP/1.1 200 OK
Set-Cookie: theme=dark; Path=/; Max-Age=2592000; Secure; SameSite=Lax
GET /notes HTTP/1.1
Cookie: theme=darkCookies are intentionally small and travel repeatedly. Store a compact identifier or preference, not a profile, document, or cached response.
The browser does not expose Set-Cookie to frontend JavaScript. Inspect it in the Network panel, then inspect the stored cookie and the next matching request.
For a script-visible preference, document.cookie is synchronous and awkward. The newer promise-based Cookie Store API is cleaner where your supported browsers provide it. Keep authentication cookies HttpOnly either way.
Set one harmless preference cookie from a local server. Capture the response and the next request, then change the request path until the cookie no longer matches.
Lesson completed