Selenium · Browser automation foundations

How do you manage cookies in Selenium?

MediumcookiessessionauthenticationUpdated Oct 2026
Quiz this track

Short answer

Use driver.manage() to add, read, delete and clear cookies. Cookies are scoped by domain and path, so you must be on the right origin before adding one, and SameSite and Secure rules still apply.

Cookies are useful for setting up authentication or feature flags without repeating the login UI. They are also a source of test leakage when a shared browser keeps a session between tests. Per-test driver isolation solves the leakage; cookie APIs handle deliberate setup.

java
driver.get("https://example.com");

Cookie session = new Cookie.Builder("session_id", token)
    .domain("example.com")
    .path("/")
    .isHttpOnly(true)
    .isSecure(true)
    .build();

driver.manage().addCookie(session);

Cookie current = driver.manage().getCookieNamed("session_id");
Assert.assertEquals(current.getValue(), token);

driver.manage().deleteCookieNamed("session_id");
driver.manage().deleteAllCookies();
Navigate to the origin before adding a cookie for that domain.
  • getCookies returns all cookies visible to the current page
  • addCookie requires a matching domain and path, or the browser may reject it
  • deleteCookieNamed removes one cookie; deleteAllCookies clears the current session
  • HttpOnly cookies cannot be read by page JavaScript but are still visible to WebDriver
  • SameSite and Secure restrictions can prevent a cookie from being sent in some contexts
  • Injecting a session cookie is faster than UI login but can mask login regressions

Use cookie injection for tests that are not about authentication, and keep a small number of real login tests that exercise the UI or API. If the token is short-lived, generate it per run rather than committing a static value. Never commit production cookies or secrets.

Cookies are not the only auth state. Some applications use local storage or indexDB. In that case, set state through the application's supported mechanism rather than assuming a cookie will work.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why must you navigate before adding a cookie?
  2. 2When would cookie injection hide a real bug?
  3. 3How do SameSite rules affect tests?
  4. 4What do you do if auth lives in local storage?

Say it in the interview

I use the cookie API to set up authentication or flags for tests that are not about login. I navigate to the origin first, because domain and path scoping apply, and I respect Secure and SameSite rules. I keep a few real login tests so cookie injection does not hide regressions. For local storage or short-lived tokens, I generate state per run and never commit secrets.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Selenium mock interview and get scored feedback on depth, clarity and confidence.