Cookie

A cookie is a key-value pair set by the server and stored by the browser, sent automatically with same-origin requests for session and state management.

Purpose

It maintains client-side state on top of stateless HTTP, enabling sessions and personalization.

Mechanism

The server sets a cookie via the Set-Cookie header; the browser stores it and returns it in the Cookie header on subsequent same-origin requests. Attributes include Domain/Path scope, Max-Age/Expires expiry, Secure (HTTPS only), HttpOnly (blocks JS access), and SameSite (cross-site restriction).

Use cases

Session IDs and login state
Shopping carts and preferences
CSRF token storage
User tracking

Examples

Input

Set-Cookie: sid=abc; HttpOnly; Secure

Output

A hardened session cookie

Blocking XSS reads

Common errors

Omitting HttpOnly lets XSS steal the cookie: Set HttpOnly, Secure, and SameSite on session cookies

Related terms

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that uses HTTP headers to control whether a page may access resources from a different origin, preventing cross-site reads.

CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site.

JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.

OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens.

References