Cookie Steps

Cookie steps assert on the state of the browser's cookie jar - the kind of checks PM and Compliance teams care about: was the consent cookie set after clicking "Accept"? Did logout actually clear the session cookie? Is the tracking cookie absent until consent is given?

All twelve steps in this group are Then assertions backed by Playwright's BrowserContext.cookies() API, so they see every cookie in the current browser context regardless of which page set it - including HttpOnly cookies that page JavaScript cannot read. Each dimension (name and value) can be matched exactly or partially ("containing"), and every positive assertion has a mirrored should not exist negative, giving a full matrix of combinations.

Partial matching is the practical workhorse: session IDs and CSRF tokens change every run, so you typically pin the stable part (a name containing "session", a value containing "v2-") rather than the full random value. If no browser context is open yet, the steps see an empty cookie jar - so "should exist" fails cleanly and "should not exist" passes.

Quick reference

Steps in detail

Then a cookie with the name "<name>" should exist

The simplest check: a cookie with the exact name is present in the browser context, whatever its value. Failure message names the missing cookie. Typical use is right after an action that should set it.

When I press "Sign in"
Then a cookie with the name "session" should exist

Then a cookie with the name "<name>" and the value "<value>" should exist

Exact name plus exact value. Fails with a distinct message for each case: cookie missing entirely, or present with a different value (the actual value is included in the error). Best for stable, deterministic values like lang=en or consent=accepted.

When I check "Remember me"
 And I press "Sign in"
Then a cookie with the name "remember" and the value "1" should exist

Then a cookie with the name "<name>" and a value containing "<substring>" should exist

Exact name, substring value match. Use it when the value has a random or timestamped component but a predictable marker - a token prefix, a flag embedded in a serialized preferences blob, and so on.

Given I am on "/cookies.html"
Then a cookie with the name "preferences" and a value containing "darkmode" should exist

Then a cookie with a name containing "<substring>" should exist (and value variants)

The partial-name family covers cookies whose names carry dynamic parts (for example Drupal's SESS<hash> session cookies). Three variants: name-substring only, name-substring plus exact value, and name-substring plus value-substring. Each finds the first cookie satisfying all its conditions and fails with a message describing exactly which combination was not found.

Then a cookie with a name containing "session" should exist
 And a cookie with a name containing "pref" and a value containing "darkmode" should exist
 And a cookie with a name containing "lang_" and the value "en" should exist

should not exist - the negative family

Every positive phrasing above has a should not exist mirror with the same matching rules. Note the semantics of the combined forms: the name "lang" and the value "fr" should not exist passes if the lang cookie is absent or present with a different value - it only fails when the exact name+value pair matches. That makes the negatives ideal for logout flows, consent rejection, and verifying legacy cookies are gone.

When I press "Logout"
Then a cookie with the name "session" should not exist
 And a cookie with a name containing "auth" should not exist
 And a cookie with the name "preferences" and a value containing "lightmode" should not exist

Complete example

Adapted from tests/features/cookie.feature, running against the examples/cookies.html fixture (which sets session_id=abc123, language=en, and preferences=darkmode-enabled):

Feature: Cookie step definitions

  Scenario: Cookie existence and value matching
    Given I am on "/cookies.html"
     Then a cookie with the name "session_id" should exist
      And a cookie with the name "session_id" and the value "abc123" should exist
      And a cookie with the name "preferences" and a value containing "darkmode" should exist
      And a cookie with a name containing "session" should exist
      And a cookie with a name containing "pref" and a value containing "darkmode" should exist
      And a cookie with the name "missing" should not exist
      And a cookie with the name "language" and the value "fr" should not exist
      And a cookie with the name "preferences" and a value containing "lightmode" should not exist
      And a cookie with a name containing "old" should not exist

Tips

• These are point-in-time checks - they read the cookie jar at the moment the step runs. If the cookie is set by an async request after a click, add a wait or a web-first assertion on visible UI before asserting the cookie.
• Prefer partial matches for anything random (session hashes, CSRF tokens) and exact matches for deterministic flags (consent, lang, A/B buckets).
• Cookies are read from the whole browser context, so cross-page and HttpOnly cookies are all visible to these steps.

Back to all step groups