Data is only present in the [cookies] section if a cookie is sent by the client to the web server or if the web server sets a cookie on the client. Data in the cookies section consist of the cookie name and its value. The data in the cookies section is derived from the HTTP request and response headers.

• The raw cookie information that is sent by the browser can be found in the HTTP_COOKIE field in the [env] section of the request block. This raw information is processed by the Cookie Parser Session Agent in the pipeline.
• The set cookie information from the web server to the client can be found in the HTTP Headers of the response buffer.

The session agent places each cookie on its own line. All of the HTTP_COOKIE values from the client are inserted first, followed by the cookie values from the HTTP_SET_COOKIE lines.

Placing each cookie on its own line makes it much easier to create events that are based on cookies.

In the following example, there are two HTTP cookies: the JSESSIONID and the Campaign cookie. Cookies are terminated by CRLF pairs.

HTTP_COOKIE=JSESSIONID=673D273706BB61B79E06629675E78875.prodWebInstance2; 
Campaign=mediacode=30&partner=&plancode=IR&LastUpdate=3%2F21%2F2007+3%3A53%3A05
##+PM&
Sample [cookies] section:
JSESSIONID=673D273706BB61B79E06629675E78875.prodWebInstance2
Campaign=mediacode=30&partner=&plancode=IR&LastUpdate=3%2F21%2F2007+3%3A53%3A05# 
+PM&referrer=www%2Egmacinsurance%2Ecom

The Campaign cookie encodes information into a single encrypted cookie value. Cookies are not decrypted into easy to understand text. They are left encoded to make it easier to create events, as they must be based on the actual bytes received in the request block.

If a specific cookie is received from the client and the web server sets that cookie again to the same value or a different value, then RTV displays the same cookie name two times: the first time with the value from the client and the second time with the value from the web server.

The following is an example with the BV_IDS cookie received and a new value that is sent back to the client:

HTTP_COOKIE=cookies=true;
BV_IDS=ccdgaddjeejfdimcflgcegjdfgndfki.0:@@@@1920104880.1161200520@@@@;
HTTP_SET_COOKIE=BV_IDS=ccckaddjeejfdhgcflgcegjdfgndfki.0:@@@@1231214819.
1161201511@@@@;path=/; |
[cookies]
BV_IDS=ccckaddjeejfdhgcflgcegjdfgndfki.0:@@@@1231214819.1161201511@@@@
cookies=true
BV_IDS=ccdgaddjeejfdimcflgcegjdfgndfki.0:@@@@1920104880.1161200520@@@@