Cookie

Sends stored cookies that match the request URL and cookie policies.

Browsers build Cookie from stored cookies; application clients must follow the cookie rules and should not put sensitive state in arbitrary values.

httpheadercookies

Reference (http)

Cookie: session=abc123; theme=dark

Browsers build Cookie from stored cookies; application clients must follow the cookie rules and should not put sensitive state in arbitrary values.

Common mistakes

Assuming the client can set or overwrite a browser Cookie header from page JavaScript.

IANA registry: http-fields/field-names

Sources