Are cookies automatically set and sent on future requests?

[cannikin]

I'm making some API requests that set and require cookies in order to respond (weird, I know, but it's a third party API). I'm noticing that if I do not capture the cookie and present it in the next request, it still works as if I did! Is posting actually storing and sending cookies automatically? I don't see anything listed in Headers so I wouldn't have thought so, but I don't know how else this API is responding to the correct user...

[cyberdr1ft3r]

Yes. Posting maintains an in-memory cookie jar and updates it with cookies received in each response. Later requests include the matching cookies when the request’s Attach cookies option is enabled.

That is why the requests work even though you do not see a manually defined Cookie entry in the Headers tab: cookies are stored separately and attached while the request is being built.

Normal cookie rules still apply, including domain, path, expiry, and Secure, so a cookie will only be sent when it matches the destination request.

One caveat is that the jar is in memory, so you should not rely on those cookies surviving an application restart. If you need reproducible authentication across sessions, keep the login request in the collection or configure the required cookie explicitly.