Topic
Browser cookies
Browser cookies are small pieces of data that a website can ask a browser to store and return with later matching requests.
At a glance
- Created by server header
- Set-Cookie
- Returned by browser header
- Cookie
Overview
HTTP cookies let a server associate later requests with state such as a session identifier or user preference. Servers create cookies with Set-Cookie response headers and browsers can return matching cookies in Cookie request headers. Cookie scope, expiration, SameSite behavior, and security attributes affect when a browser sends them and should be considered part of application security.
Sessions and preferences
A cookie can hold a short identifier that points to server-side session state or a small preference value. Sensitive applications generally avoid placing secrets or large application records directly in a cookie because the browser will repeatedly send matching cookie data with requests.
Security attributes matter
Secure limits a cookie to secure connections, HttpOnly prevents ordinary page scripts from reading it, and SameSite controls important cross-site sending behavior. These attributes reduce particular risks but do not replace server-side authorization and session validation.
Sources and review
MOOR's explanatory text is supported by the following source links.
- Using HTTP cookies — MDN Web Docs
- HTTP State Management Mechanism — RFC Editor