Disclosure first: I work on OnePassApps, the team behind app.onepassapps.com. This is a measurement of our own site's HTTP responses, not of anyone else's.

Zero Set-Cookie Headers on All 56 Pages of Our Own Site, and the Two Cache Policies

I fetched every URL in our sitemap over plain HTTPS this afternoon - no browser, no session, no cookies sent, no JavaScript - and looked at one header in particular: Set-Cookie. Not one of the 56 pages answered with a Set-Cookie header. The API host's public routes did not either.

The measurement

Our sitemap is 4,046 bytes and lists 56 URLs. One GET each, All 56 of them answered 200. Every one of them carried no Set-Cookie header, so the number of cookies the server hands out on those 56 pages is zero.

The API host answers the same way. /api/products and /api/voting both answered 200 with no Set-Cookie header. The API host's own root answers ERR HTTP Error 404: Not Found, which is a routing answer, not a cookie.

What the server sends instead

The two hosts split on caching, not on cookies. Every app-host page answered with Cache-Control: public, max-age=0, must-revalidate - public enough to be shared, and max-age=0 so a browser re-checks it on every use. The API routes answered with the opposite: private, no-store, max-age=0. The private half is the important one there: those answers are marked as not for a shared cache at all.

Across the same 56 pages and the API routes, 2 responses carried a Vary header, so nothing in what was served was being marked as varying by request shape.

Why I measured this

The wider write-up of where our pages send your data is here: https://dev.to/onepassapps/where-does-your-data-go-the-route-map-redirects-and-browser-storage-of-apponepassappscom-15be

Every claim this product makes about your data staying in the tab is a claim about code. This one is about the wire. A Set-Cookie header is the server's own way of handing your browser something to carry, and on 56 pages our server hands you nothing to carry.

Limits

One build, one afternoon, 9 November 2026, plain HTTPS from one network, no browser, no session, no cookies sent and no JavaScript executed. I did not sign in, so I make no claim about what a signed-in session's responses carry, and the browser's own storage is a separate surface from the server's headers, which this post does not measure.

Try it

The sitemap that produced the 56 URLs is at https://app.onepassapps.com/sitemap.xml

The apps behind those pages are at https://app.onepassapps.com/?utm_source=devto&utm_medium=post&utm_campaign=set-cookie-layer&utm_content=site-link

And the written guides are at https://app.onepassapps.com/guides?utm_source=devto&utm_medium=post&utm_campaign=set-cookie-layer&utm_content=guides-link