Cookie

You might say

Login succeeds, but a refresh signs the user out. Help me check whether the session cookie is set and sent back with requests.

A cookie is a small piece of data the browser stores by server rules and sends automatically on matching later requests.For example, a login response uses Set-Cookie to store a session identifier. When the browser later visits a matching address, it sends a Cookie request header so the server can find the session. A cookie is only part of the request round trip, not a complete authentication system, authorization decision, or database; sensitive sessions also need properties such as Secure, HttpOnly, and SameSite.

Know first

HTTP Browser Storage

HTTP Cookie

How a login state travels with requests

The three steps in a cookie round trip

The response asks the browser to store it: The server sends Set-Cookie in a response, and the browser decides whether to store it from its name, scope, and security attributes.

Later requests send it when conditions match: For a matching address, the browser puts sendable cookies in the Cookie request header. An HttpOnly cookie cannot be read by page script but can still be sent with a request.

Quick checkChoose the best answer

The login API returns success, but a refresh makes the user signed out again. What should you inspect first?

Check whether the response sets a session cookie and the refresh request sends it backWrite isLoggedIn=true to localStorage so the page keeps showing a signed-in stateInspect only the user record in the database, not the browser or request headers

You can say this to an AI Agent

Check whether the login response sets a secure session cookie and whether the protected request after refresh sends it automatically. Do not print the full cookie value; use Network and Storage to verify the session survives refresh, while identity and authorization remain server-side.

Learn next

1Authentication→2Browser Storage→