Store and reuse cookies

HTTP is stateless, so servers use cookies to recognize you across requests: log in once, and a session cookie proves who you are on every request after. Your browser handles this invisibly. curl does not persist cookies between commands unless you provide a cookie jar — each curl invocation is a stranger by default.

That default is why “it works in the browser but not in curl” so often comes down to a missing cookie. To script anything session-based, you need the jar.

Write, then read

Write and reuse a temporary cookie jar:

curl --cookie-jar cookies.txt 'https://httpbin.org/cookies/set?theme=dark'
curl --cookie cookies.txt https://httpbin.org/cookies

The first command hits an endpoint that sets a cookie, and --cookie-jar cookies.txt saves everything the server set. The second command sends the jar back with --cookie cookies.txt. The second response should show the stored cookie:

{
  "cookies": {
    "theme": "dark"
  }
}

Two separate processes, one continuous session. That is the whole mechanism.

For a realistic login flow you usually want both options on every command — read existing cookies, and save any updates the server sends:

curl --cookie cookies.txt --cookie-jar cookies.txt https://httpbin.org/cookies

Look inside the jar

The jar is a plain text file in the Netscape cookie format, one cookie per line:

httpbin.org	FALSE	/	FALSE	0	theme	dark

Open it and connect each field to the request logic: the domain and path decide which requests the cookie accompanies, the secure flag restricts it to HTTPS, and the expiry (0 means a session cookie) decides how long it lives. When a cookie mysteriously fails to be sent, the answer is almost always in one of these fields — a domain that does not match, a path that is too narrow, or an expiry already passed.

The jar is a credential

Cookie jars can contain session credentials. A saved session cookie is login-equivalent: anyone who reads the file can be you until the session expires. Keep jars out of Git, restrict permissions with chmod 600 cookies.txt, and remove the lab file when finished:

rm cookies.txt

Treat the jar with exactly the care you would give the password that created it.