SessionCourier install now ↗

guides

Protect cookies from changes

Pin a cookie's value so a site can't silently overwrite or delete it while you debug.

Mark a cookie as protected and SessionCourier pins its current value. A background watcher listens for cookie-change events; if anything overwrites or deletes a protected cookie, SessionCourier writes the saved value back. Protected cookies are flagged in the list so you can always see which ones are pinned.

When it helps

  • Keep a session alive while clearing other state. Protect the session cookie, then clear the rest — you stay logged in while everything else resets.
  • Pin an A/B-test or feature-flag cookie to one variant. The site can’t silently rotate you into a different bucket mid-test.
  • Stop a misbehaving script from logging you out mid-debug. If some code path keeps clobbering your session cookie, protection restores it faster than you can re-login.

Open a cookie in the editor and toggle Protect on. The first time you protect any cookie, Chrome will prompt for optional broad host access — this is required because the background worker needs that permission to write the cookie back on any domain. Once granted, protection applies instantly and survives browser restarts.

To remove protection, toggle Protect off, or delete the cookie (protection is dropped automatically before your own deletions so the watcher doesn’t fight you).

Limits

Protection is a debugging aid, not a security boundary. Restoration reacts after a change — a request may go out with the tampered value before SessionCourier writes it back. And if the server invalidates the session on its side, restoring the cookie’s value in the browser cannot bring the session back.

  • Expiry and eviction are not fought. Protection restores overwrites and explicit deletes, not natural expiry or browser eviction. An expired cookie cannot be re-set.
  • The snapshot is stored on disk. For normal browser profiles, the protected value is persisted in storage.local so the background can restore it after a browser restart. This storage is unencrypted and is not cleared by “Clear browsing data” — a site’s logout that explicitly deletes the cookie will be undone by protection as long as you have it enabled. If you want a cookie gone, turn off protection first.
  • Incognito cookies are handled differently. A cookie protected in an incognito window is stored only in session memory, not on disk, and is gone when the browser closes.
  • Broad host access is required. Without it, the background set() call is refused and the restore silently no-ops. The permission prompt appears on the first protect action and can be checked anytime under chrome://extensions.