path tells the browser which URL prefixes may send and expose a cookie. path=/ is site-wide. A narrower value like path=/shop matches /shop, /shop/, and /shop/cart — not / or /blog.
Warning Not a security boundary
Path only controls default cookie scope. It does not protect secrets from other paths on the same origin — do not treat it as access control.
Remember
document.cookie = "name=value; path=/; max-age=SECONDS"
path=/ → whole site
path=/shop → /shop and subpaths
omit path → default = page directory
delete/update → must use the same path
Goal
Prefer
App-wide cookie
path=/
Section only
path=/shop (or similar prefix)
Avoid “missing cookie”
Always set path=/ unless scoped on purpose
Delete / update
Reuse the exact original path
Approach
How to Use Cookie path
Choose a prefix, write it on every set/update/delete, and verify scope in DevTools when cookies vanish.
Decide scope: whole site (/) or a URL prefix (/shop, /admin).
Include path=... in the document.cookie assignment (prefer path=/).
On update or delete, send the same path — a mismatch creates a second cookie.
Remember: omitting path defaults to the current page’s directory, not the whole site.
name, value = cookie data
cookiePath = "/" or "/shop" or … // prefer "/"
cookie = name + "=" + encode(value) + "; path=" + cookiePath
document.cookie = cookie
// Later, on a page request:
if requestURL.path starts with cookiePath:
include cookie in document.cookie / Cookie header
else:
hide cookie from this page
Reference
Cheat Sheet
Keep these path-matching facts handy.
Topic
Detail
Site-wide
path=/
Section scope
path=/shop matches /shop/*
Default if omitted
Directory of the setting page
Match rule
Request path must start with cookie path
Delete / update
Same path (and domain) required
Read path in JS
Not available — use DevTools
Security
Path is not access control
Try it
Live Preview
Pick a cookie path and a page URL. See whether the cookie would be visible on that page (prefix match).
Demo of path prefix matching — same idea browsers use for document.cookie visibility.
Result
cookie path = /
page URL = /
match? YES
→ cookie is sent / visible on this page
/* path=/ matches every URL on the origin */
Code
JavaScript Examples
Short, copy-ready snippets. Open DevTools Console, or use Try It Yourself for a live editor.
Example 1 — Site-Wide Cookie with path=/
Make a cookie available on every page of the origin.
JavaScript
document.cookie =
"sessionId=abc123; path=/; max-age=3600; SameSite=Lax";
console.log(document.cookie);
// Readable on /, /about, /shop/cart, and this page
Write one cookie. Assign a name=value string to document.cookie.
Set root path.path=/ matches every URL on the host.
Add lifetime.max-age=3600 keeps it for one hour (optional but common).
Read anywhere. Any page on this origin can see sessionId in document.cookie.
Example 2 — Restrict Cookie to /shop
Keep a cart token only under the store section.
JavaScript
document.cookie = "cartId=xyz789; path=/shop; max-age=604800";
console.log(document.cookie);
// Sent on /shop and /shop/checkout
// NOT sent on /blog or /
prefs=compact
(works here; “disappears” on the homepage)
How It Works
Omit path. The browser picks the directory of the current page.
Deep URL → narrow scope. On /js/cookies/path, default is under /js/cookies/.
Homepage fails./ does not start with that directory → cookie seems gone.
Fix. Write path=/ unless you intentionally want a narrow prefix.
Example 4 — Path Mismatch Creates Duplicates
Updating with a different path does not replace the original cookie.
JavaScript
document.cookie = "username=John; path=/; max-age=604800";
// Attempted "update" with a different path
document.cookie = "username=Jane; path=/account; max-age=604800";
console.log(document.cookie);
// DevTools may show TWO username cookies
Create at root. First write stores username with path=/.
Write again with another path.path=/account is a different cookie key.
Both can exist. Name alone is not unique — path (and domain) complete the identity.
Update safely. Reuse the original path, or delete the old cookie first — see Cookie Update.
Edge Cases & Pitfalls
Check these before shipping path-scoped cookies.
trap
Forgetting path=/
Cookies stick to one directory. Classic “works on this page only” bug on deep routes.
dup
Update with a different path
Creates a second cookie instead of overwriting. Match path on every write and delete.
narrow
Too-narrow prefixes
path=/app/settings excludes /app/dashboard. Prefer the shared parent (/app) or /.
security
Path is not access control
Same-origin scripts can still reach cookies via other means. Keep secrets HttpOnly on the server.
Compatibility
Browser Support
The cookie path attribute is part of the long-standing cookie model and works wherever document.cookie works.
✓ Baseline · HTTP cookies
Cookie Path
Supported across Chrome, Firefox, Safari, Edge, and legacy IE. Prefix matching is consistent; verify scoped cookies in DevTools when debugging.
99%Universal attribute
Google ChromeAll versions · Desktop & Mobile
Full support
Mozilla FirefoxAll versions · Desktop & Mobile
Full support
Apple SafariAll versions · macOS & iOS
Full support
Microsoft EdgeAll versions · Chromium & Legacy
Full support
Internet ExplorerIE 6+ · Legacy environments
Full support
OperaAll modern versions
Full support
pathExcellent
Bottom line: Safe for production. Prefer path=/ for app cookies, and always reuse the same path when updating or deleting.
Analysis
Performance Notes
Choice
Effect
Best for
path=/
Sent on every request to the origin
Small, needed-everywhere values
Narrow path
Fewer pages send the cookie
Section-only data (cart, admin UI)
Many cookies
Larger Cookie headers
Avoid — keep values small
Path matching itself is cheap. The cost is bytes on matching requests. Prefer short values; for client-only data that never needs the server, consider localStorage.
Remember
Key Takeaways
Role:path sets which URL prefixes may send/read the cookie.
Default: prefer path=/ for app-wide cookies.
Match rule: request path must start with the cookie path.
Updates: reuse the same path or you create duplicates.
One line: use path=/ unless you need a narrower prefix — and always match that path on update and delete.
Frequently Asked Questions
path limits which URLs on your origin send and expose the cookie. A cookie with path=/shop is included on /shop and /shop/cart, but not on /blog or /.
The browser defaults to the directory of the page that set the cookie. A cookie set on /js/cookies/path without path is scoped under /js/cookies/, not the whole site.
Use path=/ whenever the cookie should be readable and sent on every page of your origin — theme, language, cart ID, and most app-wide preferences.
No. document.cookie returns only name=value pairs. Inspect Path in DevTools under Application → Cookies.
Usually different path (or domain) values. Updating username at path=/account does not replace username at path=/ — the browser stores both.
No. Path only controls where the cookie is sent by default. It is not meant to protect secrets from other paths on the same origin.
