Cookie Courier

⌘/Ctrl + Enter to check

Cookie delivery

Response URL

Goal cookie

Cookie jar

Choose a level

Cookie field guide

Set-CookieServer responseCookie jarBrowser storageCookieLater request
name=value
The payload, such as session=crumb. A request's Cookie header carries name–value pairs.
Domain
Omitting it makes the cookie host-only. Setting Domain=bakery.test includes that host and its subdomains. The response host must be inside that domain.
Path
Path=/shop matches /shop and /shop/cart. Matching is case-sensitive and follows slash boundaries. With no Path, the response URL's directory supplies the default.
Secure
Limits transmission to HTTPS in these puzzles. Set it from HTTPS.
HttpOnly
Hides the cookie from document.cookie. The browser can still include it in eligible HTTP requests, including requests initiated by scripts.
SameSite=Strict
Include only in same-site request contexts.
SameSite=Lax
Also permits cross-site top-level navigation using a safe method, such as GET. Cross-site POST and embedded loads do not qualify.
SameSite=None
Allows cross-site contexts, and requires Secure. Browser third-party-cookie policies can still block delivery.
Max-Age / Expires
Max-Age counts seconds from storage and takes precedence over Expires. Zero or a negative Max-Age deletes a cookie at the matching name/domain/path scope.
__Secure- / __Host-
__Secure- requires HTTPS and Secure. __Host- also requires an explicit Path=/ and no Domain attribute.
Site / origin
A schemeful site combines the scheme and registrable domain. An origin includes scheme, full host, and port. Sibling subdomains can be same-site while cross-origin.
Fetch credentials
same-origin includes cookies only for the page's origin; include allows eligible cross-origin cookies. The server's CORS rules independently govern whether script can read the response.

Why the attributes work together

Scope chooses destinations. Secure chooses transport. HttpOnly governs script access. SameSite considers the request context. Each condition must permit the operation. Session cookies also need appropriate application-side defenses, including CSRF protection and session validation.

Browser model

The puzzles use a fixed clock of January 1, 2030 and controlled .test domains. Unspecified SameSite uses Lax here. Real defaults, recent-cookie exceptions, public-suffix rules, browser session restoration, privacy policies and prefix support can vary. Partitioned cookies, redirect chains, CORS preflights and browser storage limits are outside this game's model.

Progress and drafts are saved in this browser.

References