Curl Send Cookies Example

The command

curl -b "session=abc123; theme=dark" https://httpbin.org/cookies

Run this request in the API Tester

Opens the request console with this request filled in. It is sent from api-tester.com's server rather than from your machine, so it shows what the endpoint returns, not how your own network or curl build behaves.

What the flags do

A session across several requests

A login sets a cookie in its response; later requests must send it back. Give curl a jar: -c writes cookies after each request and -b with the same filename sends the stored ones on the next. With a jar loaded, curl applies the normal rules for domain, path, expiry and the Secure flag, so each cookie goes only where a browser would send it.

# log in, saving whatever cookies the server sets
curl -c jar.txt -d "user=ada" -d "pass=secret" https://example.com/login

# use and refresh the same session
curl -b jar.txt -c jar.txt https://example.com/account

How -b decides between a string and a file

If the argument to -b contains an =, curl treats it as cookie data and sends it as written, to whatever host the request goes to. Otherwise it is a filename. An empty string, -b "", is a useful third case: it enables the cookie engine with no starting cookies, so cookies set during a redirect chain are carried along it.

The jar is a plain-text file in the Netscape format: one cookie per line with tab-separated domain, subdomain flag, path, secure flag, expiry time, name and value. It is readable, editable, and it contains live session tokens, so treat it like a password file.

curl -L -b "" https://httpbin.org/cookies/set/token/xyz   # cookie survives the redirect
cat jar.txt

Common mistakes

• -b "name=value" skips all cookie rules. The value is sent to any host, including redirect targets on other domains.
• -c alone does not send anything. It only records; pair it with -b.
• A cookie is not always enough. Forms protected against CSRF also want a token from the page, sent back in a field or header.

Related curl examples

More under Headers

• Curl Content-Type Example
• Curl User Agent Example
• Curl No Cache Example
• Curl Keep-Alive Example
• Curl Custom Headers Example
• Curl Close Connection Header Example

References

• curl man page: -b — Sending cookies from a string or a file.
• curl: HTTP cookies — How curl's cookie engine and the cookie jar file format work.
• MDN: Cookies — Attributes, scope and lifetime as browsers apply them.

These links leave api-tester.com, which is independent of the projects they point to.

FAQ