cookie

The cookie crate is the de facto standard Rust library for parsing and building HTTP cookies, with a CookieJar type that tracks additions, removals, and modifications so a web server can compute exactly which Set-Cookie headers to send. Beyond plain cookies, it supports signed jars (tamper-evident via HMAC) and private jars (encrypted and authenticated via AES-GCM) behind opt-in feature flags.

With over 190 million total downloads, it’s a foundational dependency embedded in most Rust web frameworks (Rocket, Actix Web, Axum via tower-cookies, and others), making it one of the most widely-used low-level building blocks in the Rust web ecosystem.

What You Get

• A Cookie type and builder API for constructing cookies with name, value, domain, path, expiration, Secure, HttpOnly, and SameSite attributes
• A CookieJar that tracks original, added, and removed cookies so a server can emit the correct Set-Cookie deltas
• Optional signed and private jar wrappers (via Cargo features) providing HMAC-signed and AES-GCM-encrypted cookies with authenticated integrity
• A percent-encode feature for percent-encoding cookie values, and cookie-prefix support (__Host-, __Secure-) via the prefix module

Common Use Cases

• Session management in a Rust web server, using signed or private cookie jars to store session identifiers or user state tamper-proof
• Parsing incoming Cookie request headers and building outgoing Set-Cookie response headers in a custom HTTP server or middleware
• Implementing secure cookie prefixes (__Host-, __Secure-) to harden cookies against subdomain and network attacks
• Serving as the underlying cookie primitive inside higher-level framework integrations like Rocket’s cookie support or tower-cookies for Axum/Tower

Under The Hood

Architecture — The crate centers on a Cookie struct (src/lib.rs, ~1,940 lines) representing a single cookie’s name/value/attributes, a CookieJar (src/jar.rs, ~808 lines) that diff-tracks original vs. current cookie state to compute Set-Cookie deltas, and a CookieBuilder (src/builder.rs) for ergonomic construction; parse.rs implements RFC 6265 cookie-header parsing, while secure/ layers signed (HMAC) and private (AES-GCM) jar wrappers on top of the base jar. Tech Stack — Pure Rust with a minimal required dependency (time for expiration handling); the secure feature set pulls in aes-gcm, hmac, sha2, base64, rand, hkdf, and subtle only when opted into, keeping the default build lean. Code Quality — Core modules (lib.rs, jar.rs, parse.rs) each carry dedicated #[test] suites (27+ test functions across the three), a fuzz/ directory for fuzz-testing the parser, and a documented MSRV support matrix in the README tied to each released version range. API Design — The builder pattern (Cookie::build(name, value)...finish()) and jar’s add/remove/get/delta methods read as idiomatic Rust, and feature-gating the cryptographic (secure) functionality keeps the common case (plain cookie parsing) dependency-free and fast to compile.