Overview
Identifying the source of cookies is especially critical when working to ensure your websites are compliant with data privacy standards through out the globe.
Cookies are set on a web page through two methods, network request response headers and JavaScript.
Here we'll explain how to identify the source of a cookie and move towards privacy compliance.
Note: It's critical to understand the persistent nature of cookies. Not every page where a cookie is present in a report, is the page responsible for setting that cookie. Cookies can bleed from page to page and ensuring you have set up Audits properly can help you avoid confusion and have more clear reporting.
Cookies Set by Network Request Response Headers
To identify the source of a cookie that is set by network request response headers, follow the steps below.
Open the dev console and navigate to the Application ribbon.
From there, expand the Cookies drawer on the left hand side and find the cookie that you want to identify the source of.
Right click the cookie and select Show Requests With This Cookie.
This will take you to the Network ribbon and apply a filter for you showing all requests that reference that cookie (not every request that references a cookie, sets the cookie).
If no results turn up, then the cookie was set via JavaScript and you should skip to the guide below on Cookies Set by JavaScript. Otherwise, go to the next step.
Click through each network request and look at the Response Headers for a set-cookie header. Not all requests will have one, but if they do, it means that network request set a cookie on the page.
Search through each request until you find the network request that contains the cookie you are looking for in the set-cookie header.
Cookies Set by JavaScript
To identify the source of a cookie that is set by JavaScript, follow the steps below.
Open the dev console and click the 3 dot menu icon in the top right corner
Hover over More Tools and select Search
Use the newly available search bar to search for the cookie name across all source code on the page.
If multiple files appear, inspect each and look for "document.cookie" or cookies being assigned a value (e.g. cookie_name=abc123). This should indicate that this file is setting the cookie in question.
If you require additional support or have questions reach out to [email protected] for help!