Cookies

Each environment has its own cookie jar in environments/<id>/.state/cookies.json. Renaming an environment carries the jar with it; deleting the environment deletes its cookies. The Cookies panel lets you inspect, create, edit, delete, filter, or clear cookies for the active environment.

Capture from responses

Fetchpier validates every Set-Cookie value before storing it. It rejects a cookie when, among other RFC 6265 constraints:

• the response host has no authority over the requested domain;
• the domain is a public suffix;
• a reserved security-prefix rule is not satisfied;
• an insecure response attempts to replace a secure cookie.

A rejected cookie remains visible in the response viewer, struck through with its host and rejection reason. It is never dropped silently. Cookies accepted on an earlier redirect hop remain stored even if a later hop fails.

A cookie without a Domain attribute is host-only and is not sent to subdomains. A cookie with a valid Domain attribute covers that domain and its subdomains. Relative lifetimes are measured from the most recent receipt, and expired cookies are removed when the jar is read.

SameSite and HttpOnly are preserved and displayed. They do not restrict sends in an API client: there is no initiating website or page script. Fetchpier warns about combinations that a browser would reject, such as SameSite=None without Secure, so browser/API-client differences remain visible.

Attach to requests

For every request and redirect hop, Fetchpier selects cookies by host, path, secure connection, and expiry. It attaches them when the resolved disableCookieJar setting is false and the request has no # @disable-cookie-jar marker.

An explicitly authored Cookie: header wins completely and is sent exactly as written; Fetchpier does not merge it with the jar. The explicit header only controls outgoing cookies. Response cookies are still captured unless the cookie jar is disabled for the request.

Inspect a send

The response Cookies tab lists both directions: cookies attached to the request and cookies offered by the response. Rows include name, value, domain, path, expiry, host-only, secure, HTTP-only, and cross-site attributes. Redirect chains identify the relevant hop, and the tab signals cookie warnings separately from its row count.

Table columns initially fit the panel and can be resized by dragging a boundary. The adjacent column gives up the same width so the table continues to fit.

Manage the jar

The Cookies panel groups entries by domain and filters by name or value. Edits apply to the next matching send immediately. Clearing the jar asks for confirmation and removes every cookie in the active environment only.

Use the per-request setting when a test must neither send existing cookies nor retain new ones. Use an explicit Cookie: header when a request needs a controlled cookie value while response capture should remain enabled.