- 1 Confirm the prefix is on the cookie line
A valid row looks like
#HttpOnly_.example.comthen tabs. A real comment is# This file was generated. - 2 Paste into the converter
Output JSON Array should list the cookie with
"httpOnly": true. Netscape output writes the prefix back — that is what curl wants. - 3 Replace naive scripts
Do not
grep -v "^#"a cookies.txt. Use this parser, curl, or CookieMan Import.
Symptom → cause → fix
| Symptom | Cause | Fix |
|---|---|---|
| Session cookie missing after “parse” | Filter dropped #HttpOnly_ lines | Use a prefix-aware reader (this one) |
| JSON has httpOnly false after Netscape import | Reader treated the line as a comment | Re-paste here; do not strip hashes first |
| File has only comments | Exporter wrote a header and no rows | Re-export from CookieMan; empty jar |
# Netscape HTTP Cookie File
# a real comment — ignored
#HttpOnly_.example.com TRUE / TRUE 1789200000 session_id abc123
The serializer always emits
#HttpOnly_ when httpOnly is true. Round-trip JSON → Netscape → JSON keeps the flag. SameSite is still lost on that path. What the prefix is not
It is not an HTTP comment in the RFC 6265 sense. It is not a Chrome cookies API field. It is a curl jar convention that this library implements on purpose, including files whose only cookie is HttpOnly.