How a cookie works
HTTP itself is stateless: every request is independent. Cookies solve this. In response to the first request the server adds a Set-Cookie header with a value, and the browser saves it and returns it in the Cookie header on every following request to that URL — whether it is a GET for a page or a form submission. This is how sessions, authentication and shopping carts are kept.
Attributes and security
Cookies have attributes that control their scope and protection:
- Secure — the cookie is sent only over a secure HTTPS connection.
- HttpOnly — JavaScript cannot read the cookie, which lowers the risk of theft through an XSS attack.
- SameSite — limits sending the cookie to third-party sites and guards against CSRF.
Lifetime (Expires or Max-Age) and scope (Domain, Path) are set as well. Cookies power sessions, authentication and analytics — but because of tracking they are subject to privacy rules.
