Cookie Test

Introduction

cookie write, read, and delete on the DeviceHub origin so you can verify first-party scripted cookies still function in your profile, without cookie-editor extensions for a basic round-trip. Developers diagnosing login stickiness, QA validating hardened privacy settings, educators demonstrating cookie basics, and support agents confirming cookies disabled claims get a clear workflow: write a benign test name, read it back, delete it. DeviceHub is explicit: this is not a third-party tracker audit, not an exhaustive Secure/HttpOnly/SameSite laboratory for every server-set combination, and not a GDPR scanner. HttpOnly cookies set by servers remain invisible to script by design. Pair with Browser Storage Test for non-cookie state, Browser Storage Test for quota estimates, and Browser Information when cookieEnabled flags belong in the same note. Retail sites debugging cart loss after enabling strict tracking prevention run this smoke before rewriting checkout servers. LMS platforms verifying session cookies in school Chromebooks distinguish IT cookie blocks from application bugs using a pass/fail on this origin. Firefox strict tracking tests often need side-by-side normal window comparison, not only DeviceHub smoke in one mode. Safari’s “Block all cookies” toggle yields instant write failures here, pair failure with Browser Information cookieEnabled row in the same ticket. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. Subscription paywalls testing “remember me” after Safari updates run this smoke on the DeviceHub origin before rewriting auth servers. Safari “Block all cookies” yields instant write failures, pair with Browser Information cookieEnabled in the same ticket. Extensions auto-deleting cookies mid-test cause flaky failures, disable cleaners temporarily for fair smoke. __Host- prefix cookies require Secure and Path=/, this smoke uses simpler names but production failures may be prefix rules. Double-submit CSRF tokens stored in cookies remain HttpOnly in production, this smoke never sees them even when login works.

What this tool does

cookie, read the string back, and expire the name on the same path rules this origin uses. cookie entirely. The tool does not set advertising trackers or exfiltrate values to DeviceHub servers as part of the pass/fail UI design. Success and failure states label whether the block came from browser settings versus script errors so tickets route correctly. CHIPS partitioned third-party cookies are out of scope for this first-party round-trip. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. HttpOnly session cookies remain invisible, login may work while this smoke validates scripted non-HttpOnly round-trip only. Enterprise policies blocking all cookies produce immediate failures, environment fact, not DeviceHub regression. Partitioned CHIPS cookies behave differently in third-party embeds, DeviceHub first-party smoke does not model ad iframes. Lax SameSite defaults broke cross-site POST flows in 2020-era apps, first-party DeviceHub smoke still passes while SSO iframes fail.

When to use it

Use Cookie Test when sessions fail to stick, after enabling strict tracking prevention, when comparing browsers for basic cookie support, and before blaming application code for cookie bugs that are actually policy blocks. Prefer storage sibling tools when the app uses localStorage instead of cookies for session tokens. Use when Firefox ETP strict mode is suspected, compare normal versus private windows on the same machine. Production HttpOnly session cookies remain invisible here even when login works, smoke validates script cookies only. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. SameSite policy changes over years mean production cross-site logins differ from this first-party DeviceHub smoke. Production Set-Cookie Secure flags differ from this simple HTTPS smoke, server header cookies are separate concern. Cookie Store API when present is separate from document.cookie, matrix row in Browser Features clarifies which path production uses. Cookie size approaching four kilobytes per domain triggers silent write failures, large JWT cookies fail before localStorage limits.

How it works

cookie exposes a limited scripting interface for non-HttpOnly cookies subject to path, domain, Secure, and SameSite attributes the test sets explicitly for its benign name. Browser settings, enterprise policy, and extensions can block sets silently or throw depending on engine. Secure contexts matter for many real-world cookie patterns even when this simple smoke succeeds on HTTPS DeviceHub. Permissions remain none, cookies here are not microphone or camera flows. cookie, that behavior is correct, not a test failure. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. cookie capability, smoke here validates broader scripting. Firefox strict mode comparisons need side-by-side normal window runs, not only private mode anecdotes. IT allowlists whitelisting SSO domains do not guarantee general document.cookie capability, smoke here validates broader scripting. IT cookie blocklists targeting tracking domains may still allow first-party DeviceHub smoke while breaking SSO elsewhere.

Step-by-step instructions

1. Open Cookie Test on the DeviceHub origin over HTTPS with auto-delete extensions temporarily disabled for a fair test. Disable auto-delete extensions temporarily so the round-trip is not fighting background cleaners.
2. Run the write action and confirm success messaging for the short-lived test cookie name. Run smoke twice if first attempt failed after an IT policy popup, confirm stable failure not transient glitch.
3. Read back the value through document.cookie and note empty reads when policy blocks scripted cookies. Note subdomain and path explicitly when comparing to production cookie domain configuration.
4. Delete the test cookie with the provided control and verify it no longer appears in document.cookie. If delete fails, verify test cookie name matches write name exactly including case sensitivity rules.
5. If writes fail, inspect browser cookie settings and compare cookieEnabled via Browser Information. Capture cookieEnabled from Browser Information in the same session when write fails mysteriously.
6. When production uses HttpOnly session cookies, remember this smoke only validates scripted cookies, not server header cookies your app relies on. Remind stakeholders HttpOnly production cookies are invisible here by design, not oversight.

Common problems

Extensions that auto-delete cookies fight the round-trip mid-test. Partitioned third-party contexts behave unlike top-level DeviceHub tabs. Expecting to read HttpOnly session cookies from script always fails, that is correct browser security. Confusing this smoke with enterprise compliance scanning overpromises. SameSite=Lax production cookies behaving differently on cross-site POST redirects will not be fully modeled by this first-party smoke. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. Subscription sites testing remember-me after Safari updates run DeviceHub smoke before rewriting auth servers. cookie size limits hit before localStorage on some paths, large cookie tests fail earlier than engineers expect. document.cookie size limits hit before localStorage on some paths, large cookie tests fail earlier than engineers expect. Max-Age versus Expires parsing bugs in legacy middleware show up as intermittent delete failures, note server header style.

Privacy explanation

Only a benign test cookie for this diagnostic should be written. DeviceHub does not upload cookie contents for the on-page UI. No mic or camera permission is requested. Remove the test cookie when finished if any residue remains. The test name is intentionally generic, avoid reusing production cookie names when experimenting manually. Enterprise cookie blocklists sometimes allow exceptions only for SSO domains, DeviceHub origin smoke still validates general scripted cookie capability. The benign test cookie name is not HttpOnly, production session cookies may still be HttpOnly while this smoke passes. CHIPS partitioned third-party cookies are out of scope, embedded ad cookies behave differently from this origin test. Cookie smoke passing does not certify third-party tracker ecosystems, marketing compliance scans are separate projects. Safari ITP cross-site tracking prevention does not always block first-party write smoke, still pair with Browser Information.