Cookie Inspector β
The COOKIES tab captures every cookie the moment it is set β with the exact request that created it.
Overview β
Unlike browser DevTools that only show cookies, Nothing Browser shows you which API call set each cookie. This is critical for understanding authentication flows.
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β COOKIES [38] β
βββββββββββββββββ¬ββββββββββββββββββ¬ββββββββββββββββββ¬ββββββββββββββββββββββββββ€
β Name β Value β Domain β Expires β
βββββββββββββββββΌββββββββββββββββββΌββββββββββββββββββΌββββββββββββββββββββββββββ€
β session_id β abc123def456... β .example.com β 2026-01-15 14:30:00 β
β csrf_token β xyz789... β .example.com β Session β
β _ga β GA1.2.abc... β .example.com β 2027-01-01 00:00:00 β
β user_pref β dark_mode β .example.com β 2026-12-31 23:59:59 β
βββββββββββββββββ΄ββββββββββββββββββ΄ββββββββββββββββββ΄ββββββββββββββββββββββββββ2
3
4
5
6
7
8
9
10
What Gets Captured β
| Column | Description | Special Indicator |
|---|---|---|
| Name | Cookie name | π Orange = HttpOnly |
| Value | Full cookie value | β |
| Domain | Domain the cookie belongs to | β |
| Path | Cookie path scope | β |
| HttpOnly | Yes/No | Cannot be accessed by JavaScript |
| Secure | Yes/No | Only sent over HTTPS |
| Expires | Expiry date or "Session" | Session = deleted on close |
HttpOnly Indicator β
| Color | Meaning |
|---|---|
| π Orange | HttpOnly flag set (cannot be read by JavaScript) |
| βͺ Normal | Not HttpOnly (JavaScript can access) |
Expiry Types β
| Value | Meaning |
|---|---|
Session | Cookie deleted when browser closes |
Date | Cookie expires on that date |
(empty) | Persistent with no expiry |
Set-By Request Tab β The Killer Feature β
Click any cookie to see the exact request that set it.
What You See β
| Field | Description |
|---|---|
| URL | Full request URL |
| Method | GET, POST, PUT, etc. |
| Headers | All request headers |
| Response Headers | Set-Cookie header that created this cookie |
Example β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Set-By Request β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β URL: https://api.example.com/auth/login β
β Method: POST β
β β
β Request Headers: β
β Content-Type: application/json β
β User-Agent: Mozilla/5.0 ... β
β β
β Response Headers: β
β Set-Cookie: session_id=abc123; Path=/; HttpOnly; Secure β
β Set-Cookie: csrf_token=xyz789; Path=/ β
β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Why This Matters β
| Question | Without This | With This |
|---|---|---|
| Which API set this cookie? | Guess | See exactly |
| What request body was sent? | Unknown | Full request shown |
| What headers were used? | Unknown | Full headers shown |
| Is it HttpOnly/Secure? | Check manually | Shown clearly |
When you need to know which API call created an authentication cookie, you don't have to guess.
Copy All Cookies as JSON β
The COPY ALL JSON button outputs all captured cookies as a JSON object:
{
"session_id": "abc123def456ghi789",
"csrf_token": "xyz789uvw456",
"_ga": "GA1.2.123456789.1234567890",
"user_preferences": "{\"theme\":\"dark\",\"language\":\"en\"}"
}2
3
4
5
6
Use Cases β
- Session persistence β Save cookies to file, restore later
- API testing β Import cookies into Postman/Insomnia
- Scraping β Use cookies in Python requests
- Debugging β Compare cookie values across sessions
Cookies in Exports β
When you export a request from the NETWORK or EXPORT tab, cookies are automatically matched to the request URL and included.
Python Export β
import requests
cookies = {
"session_id": "abc123def456",
"csrf_token": "xyz789uvw456"
}
response = requests.get("https://api.example.com/data", cookies=cookies)2
3
4
5
6
7
8
cURL Export β
curl -X GET 'https://api.example.com/data' \
-H 'Cookie: session_id=abc123def456; csrf_token=xyz789uvw456'2
JavaScript Export β
fetch('https://api.example.com/data', {
headers: {
'Cookie': 'session_id=abc123def456; csrf_token=xyz789uvw456'
}
})2
3
4
5
How Matching Works β
| Rule | Description |
|---|---|
| Domain match | Cookie domain matches request URL |
| Path match | Cookie path matches or is parent |
| Secure match | HTTPS requests only get Secure cookies |
| HttpOnly | Included in exports (can't be read by JS anyway) |
Real-World Use Cases β
1. Reverse Engineering Authentication β
1. Log in to the site
2. Check COOKIES tab
3. Find the session cookie
4. Click "Set-By Request"
5. See exactly which API call created it
6. Replicate that API call in your scraper2
3
4
5
6
2. Session Export for Scraping β
1. Log in manually in Nothing Browser
2. Click COPY ALL JSON
3. Save cookies to file
4. Use in Python scraper with requests
5. Session stays authenticated2
3
4
5
3. Debugging Cookie Issues β
1. Site says "session expired"
2. Check COOKIES tab
3. See if cookie has expiry date
4. Check if Secure flag mismatches (HTTP vs HTTPS)
5. Check if Path is correct2
3
4
5
4. Comparing Cookie Differences β
1. Log in with account A
2. Copy cookies to file A
3. Log in with account B
4. Copy cookies to file B
5. Compare differences2
3
4
5
Cookie Attributes Explained β
| Attribute | Meaning | Security Impact |
|---|---|---|
| HttpOnly | Cannot be read by JavaScript | β Prevents XSS theft |
| Secure | Only sent over HTTPS | β Prevents MITM |
| SameSite | Controls cross-site sending | β Prevents CSRF |
| Domain | Which domains receive the cookie | β οΈ Wide domains = risk |
| Path | Which URL paths receive the cookie | Low impact |
| Expires | When cookie is deleted | Session = more secure |
Filtering Cookies β
Use the filter bar to find specific cookies:
| Filter | Example |
|---|---|
| By name | session |
| By domain | .example.com |
| By HttpOnly | httponly:true |
| By Secure | secure:true |
| By Session | session:true |
Clearing Cookies β
Clear Single Cookie β
Select cookie β Click DELETE
Clear All Cookies β
Click CLEAR ALL button
Clear by Domain β
Filter by domain β Select all β Delete
Privacy Note β
Cookies captured in DEVTOOLS are:
- β Stored only in memory
- β Cleared when you click CLEAR
- β Not saved to disk (unless you export)
- β Wiped when browser closes
Troubleshooting β
Cookie Not Appearing β
Solutions:
- Check DEVTOOLS is open
- Check you're on the COOKIES tab
- Refresh the page to trigger cookie setting
- Check if cookie was set via JavaScript (may appear later)
Set-By Request Empty β
Possible causes:
- Cookie was set by JavaScript, not HTTP response
- Cookie existed before capture started
- Cookie was modified after setting
Cookie Value Truncated β
Solution: Click the cookie to see full value in detail panel
Exported Cookies Missing β
Solution: Check domain/path matching β cookies must match the request URL
Keyboard Shortcuts β
| Shortcut | Action |
|---|---|
Ctrl+F | Focus filter bar |
Delete | Delete selected cookie |
Ctrl+A | Select all cookies |
Ctrl+C | Copy selected cookie as JSON |
API Reference (for Developers) β
The cookie data is available programmatically:
Via Piggy β
// Get all cookies
const cookies = await site.cookies.list();
// Get specific cookie
const session = await site.cookies.get("session_id");
// Set cookie
await site.cookies.set("name", "value", ".example.com", "/");2
3
4
5
6
7
8
Via C++ (Plugins) β
// Access captured cookies
QVector<CookieData> cookies = capture->cookies();
for (const auto& cookie : cookies) {
qDebug() << cookie.name << cookie.value;
}2
3
4
5
Next Steps β
- Network Inspector β HTTP requests that set cookies
- DEVTOOLS Tab β Complete capture overview
- Session Management β Save cookies across sessions
Nothing Ecosystem Β· Ernest Tech House Β· Kenya Β· 2026