Postman Cookies and Sessions

A cookie is a small piece of text that a server asks a client to remember. Websites use cookies to keep users logged in, store preferences, and track shopping carts. Postman acts like a browser here: it stores cookies from responses and sends them back with later requests.

The Coat Check Picture

At a theater coat check, you hand over a coat and receive a numbered ticket. The ticket proves the coat is yours. A session cookie works like that ticket. After login, the server hands the client a session ID. Every later request shows the ID, and the server recognizes the user.

  1. POST /login (email + password)
        │
  2. Server replies:  Set-Cookie: sessionId=abc123
        │
  3. Postman stores the cookie in its cookie jar
        │
  4. GET /profile
     Cookie: sessionId=abc123      ← sent automatically
        │
  5. Server recognizes the session and returns the profile

Cookie Attributes

Attribute	Meaning
Name and Value	The stored data, such as sessionId=abc123
Domain	The website allowed to receive the cookie
Path	The URL section where the cookie applies
Expires or Max-Age	When the cookie disappears
Secure	Send only over HTTPS
HttpOnly	Hide the cookie from browser scripts
SameSite	Limits sending cookies on cross-site requests

View Cookies in a Response

Send a login request and open the Cookies tab in the response panel. Postman lists every cookie the server set, along with its domain, path, and expiry. The Headers tab shows the raw Set-Cookie lines.

Use the Cookie Jar

The cookie jar is Postman's storage for cookies. Click the Cookies link under the Send button to open the manager.

• Browse cookies grouped by domain.
• Add a cookie by hand for a chosen domain.
• Edit a value to test how the server reacts.
• Delete one cookie or every cookie for a domain.

Postman sends matching cookies automatically. No header setup is needed once the jar holds the right cookie.

Add a Cookie Manually

1. Open the cookie manager and select the domain.
2. Click Add Cookie.
3. Edit the text to the format name=value; Path=/;.
4. Click Save.

Work with Cookies in Scripts

// Read a cookie value from the latest response
const session = pm.cookies.get("sessionId");
console.log("Session ID:", session);

// Test that a cookie exists
pm.test("Session cookie was set", function () {
    pm.expect(pm.cookies.has("sessionId")).to.be.true;
});

Use the cookie jar methods to set or clear cookies programmatically.

const jar = pm.cookies.jar();
jar.clear(pm.request.url, function (error) {
    if (error) { console.log(error); }
});

Postman asks you to allow script access for each domain. Open the cookie manager and approve the domain before scripts can read or change its cookies.

Cookies Compared with Tokens

Aspect	Session Cookie	Bearer Token
Sent through	Cookie header, automatically	Authorization header, set by you
Typical client	Web browsers	Mobile apps and API clients
Server memory	Server often stores the session	Server often stores nothing

Scenarios to Test

• Access a protected page after login and confirm success.
• Clear the cookie and confirm the server returns 401.
• Replace the session value with random text and confirm rejection.
• Check that the session cookie carries the Secure and HttpOnly flags.
• Confirm that logout removes or invalidates the cookie.

Key Points

• Cookies let servers remember clients between requests.
• Postman stores response cookies in a cookie jar and resends them automatically.
• The Cookies tab and cookie manager reveal every attribute.
• Scripts read and clear cookies after you approve the domain.
• Security attributes such as Secure and HttpOnly deserve a test.