Cookie request headers

Fixed and Tracked Cookie FAQ

The exact behavior of Cookie tracking, replacement, retention, conflicts, permissions, and migration.

What can I configure?

Each Profile can contain Fixed Cookies and Tracked Cookies. A Fixed Cookie has a name and a value to send. A Tracked Cookie registers the name whose value should be captured from Set-Cookie responses.

How is a Tracked Cookie updated?

Header Relay inspects matching responses from enabled Profiles and stores values only for registered Cookie names. If the same response contains the same name more than once, the last valid update or deletion wins.

How are Cookie deletions handled?

A valid Max-Age of zero or less deletes the tracked value. If Max-Age is absent, an Expires date in the past also deletes it. Max-Age takes precedence when both are present. One malformed Set-Cookie entry does not block valid siblings.

What happens to Cookies managed by Chrome?

Header Relay never changes Chrome's cookie store. If one or more managed values apply, it completely replaces the outgoing Cookie header for that request. If no managed value applies, Chrome's original Cookie header is left unchanged.

Are Domain, Path, Secure, HttpOnly, or SameSite reproduced?

No. Header Relay tracks a Cookie name and value, and uses Max-Age or Expires only to detect deletion. Target Origins and Excluded Paths determine where the value can be sent.

What if a Fixed and Tracked Cookie use the same name?

Within one Profile, the Fixed Cookie wins. Cookie names are case-sensitive, so SID and sid are treated as different names.

What if multiple Profiles match?

Different Cookie names are combined into one header. The same configured name across matching enabled Profiles is a conflict, and Header Relay stops its managed DNR rules instead of choosing a value silently.

What happens on an Excluded Path?

That Profile's managed Cookies are not sent on the excluded path. Other matching Profiles can still contribute their Cookies when the combined result can be represented safely.

Where can I inspect Cookie values?

Current values are shown in the manager, Popup, and URL Probe. Tracked values can be cleared individually or for the whole Profile.

How long are Tracked Cookies retained?

Only for the current browser session. They are cleared after browser or extension restart, Profile disablement, Cookie or Target Origin changes, host-permission revocation, or an explicit clear action.

Are Cookie names and values stored in logs?

Audit logs may include a parsed Cookie name and processing result, but never the value or raw Set-Cookie string. Analytics include neither names nor values, Target Origins, or user-entered strings.

What happens to existing generic Cookie header settings?

Convertible Fixed Header Cookie settings are migrated to dedicated Fixed Cookies. Settings that cannot be converted without loss, and Captured Header Cookie settings whose target name cannot be inferred, are preserved as migration issues for manual review.

Does this require a new Chrome permission?

No. Header Relay does not request the cookies permission. It uses its existing webRequest, declarativeNetRequest, and per-Target-Origin host access.