Automatically updates the Cookie header in Burp Repeater requests using Set-Cookie values from responses. This Bambda CustomAction preserves all existing cookies and only updates or adds values when necessary — ensuring session continuity without overwriting unrelated cookies.

update_cookie_BambdaCA.java

// 1. Build a map of updated cookies from Set-Cookie headers
var updatedCookies = new java.util.HashMap<String, String>();

for (var header : requestResponse.response().headers()) {
    if (header.name().equalsIgnoreCase("Set-Cookie")) {
        var cookiePair = header.value().split(";", 2)[0]; // only take name=value
        var parts = cookiePair.split("=", 2);
        if (parts.length == 2) {
            updatedCookies.put(parts[0].trim(), parts[1].trim());
        }
    }
}

if (updatedCookies.isEmpty()) {
    logging.logToOutput("No Set-Cookie headers found. Nothing to update.");
    return;
}

// 2. Get current Cookie header (if any) and parse
var originalCookies = new java.util.LinkedHashMap<String, String>();
var request = requestResponse.request();
String existingCookieHeaderValue = null;

for (var header : request.headers()) {
    if (header.name().equalsIgnoreCase("Cookie")) {
        existingCookieHeaderValue = header.value();
        var cookiePairs = header.value().split(";");
        for (var pair : cookiePairs) {
            var parts = pair.trim().split("=", 2);
            if (parts.length == 2) {
                originalCookies.put(parts[0].trim(), parts[1].trim());
            }
        }
        break;
    }
}

// 3. Apply updates to cookies
boolean changed = false;
for (var entry : updatedCookies.entrySet()) {
    var name = entry.getKey();
    var newVal = entry.getValue();

    if (!newVal.equals(originalCookies.get(name))) {
        originalCookies.put(name, newVal);
        changed = true;
    }
}

// 4. Add new cookies if they didn't exist
for (var entry : updatedCookies.entrySet()) {
    if (!originalCookies.containsKey(entry.getKey())) {
        originalCookies.put(entry.getKey(), entry.getValue());
        changed = true;
    }
}

// 5. Only update request if something actually changed
if (!changed) {
    logging.logToOutput("✅ Cookie header already up to date. No changes made.");
    return;
}

// 6. Rebuild Cookie header and create updated request
var cookieHeaderValue = originalCookies.entrySet().stream()
    .map(entry -> entry.getKey() + "=" + entry.getValue())
    .collect(java.util.stream.Collectors.joining("; "));

var newRequest = request.withRemovedHeader("Cookie")
                        .withHeader("Cookie", cookieHeaderValue);

// 7. Apply and log
httpEditor.requestPane().set(newRequest);
logging.logToOutput("✅ Cookie header updated: " + cookieHeaderValue);