Cookie Monitoring

A Cookie Monitor fingerprints a page's Set-Cookie response headers on every check and compares that fingerprint against the last one on record — catching a cookie quietly losing its Secure or HttpOnly flag, a new third-party cookie appearing, or an expected cookie disappearing entirely.

Availability

Available on every plan — a single HTTP request costs nothing like Synthetic or Screenshot Monitoring's browser overhead.

How it works

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msph_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Login page cookies",
    "type": "cookie",
    "target": "https://example.com",
    "intervalSeconds": 300,
    "timeoutSeconds": 30
  }'

Every check fingerprints each cookie's name, domain, path, and security attributes (Secure, HttpOnly, SameSite) — deliberately never its value. Most real sites rotate a session or CSRF cookie's value on every single request; tracking values would flag nearly every check as "changed" and make the feature useless noise. What's actually worth alerting on is a cookie's identity or security posture changing, not its value.

This ships with a zero-config default alert — "Cookies Changed" — the moment a cookie is added, removed, or loses a security attribute, no rule setup required, the same convention the built-in "Monitor Down" alert already uses. A monitor's very first check only ever establishes its baseline; nothing is flagged as "changed" until there's a previous fingerprint to differ from.

How it runs

Like WHOIS and DNSBL monitors, a Cookie monitor doesn't go through Blackbox Exporter or Prometheus. It runs on MonSPHERE's own internal scheduler, the same one Heartbeat and Synthetic monitors use, so there's no region to pick.

Bot protection: if the site serves a bot-protection challenge (such as Cloudflare's "Just a moment...") instead of the page, the check says so and keeps your last real baseline — a challenge page sets fresh cookies on every request and would otherwise flag a change on every check. An ordinary error page (404, 500) is still checked: it appearing is a real change.