Core Concepts

HttpOnly vs Client-Side Storage

Cookies marked HttpOnly cannot be accessed or modified by client-side JavaScript (cookieStore or document.cookie). However, the browser automatically attaches active HttpOnly cookies to outgoing HTTP request headers (Cookie).

To inspect current HttpOnly values: Look at the Cookie request header of any outgoing HTTP request via get_network_request.
To inspect how cookies were created or configured: Look at the Set-Cookie response header of login/auth responses.
To inspect non-HttpOnly cookies: Use evaluate_script with the modern cookieStore API (async () => await cookieStore.getAll()).

Session Strategy: Live Tab vs Isolated Context

Choose the right session environment to avoid state contamination (e.g., residual analytics or auth tokens):

Strategy	When to Use	Setup / Teardown
Live Tab (Active Page)	Diagnosing an active user session, live 401/403 error, or current state.	Operates directly on the currently selected page.
Clean-Slate (`isolatedContext`)	Testing cookie consent banners, first-time visits, or zero-cookie guarantees.	Call `new_page` with a unique `isolatedContext` (e.g. `"consent-audit-1"`). When finished, call `close_page`.

cookie-debugging

Core Concepts

HttpOnly vs Client-Side Storage

Session Strategy: Live Tab vs Isolated Context