English
Menu

What is Cookie (HTTP cookie)?

A small piece of name-value data that a web server has the browser store with the Set-Cookie header. The browser then attaches it automatically in the Cookie header to later requests to the same site. It is often used to hold a session ID so that a login state can be kept over stateless HTTP. Attributes such as Secure (send only over HTTPS), HttpOnly (hide from scripts), SameSite (whether to attach it to requests started from other sites) and Expires/Max-Age (expiry) specify how it is handled.

Japanese name: Cookie

Cookie (HTTP cookie) appears in 6 practice questions across 2 topics, including Web Technology Basics, Information Security Basics.

Field: Web Technology Basics

How it works

The server adds a header such as "Set-Cookie: sid=…" to a response, and the browser stores it. From then on, the browser automatically attaches "Cookie: sid=…" to requests to the same site (the scope set by the Domain and Path attributes). The server uses the session ID it receives to look up the user information it keeps on its own side. A cookie with no expiry specified is generally deleted when the browser is closed.

Attributes for security

With Secure, the cookie is sent only over HTTPS, which keeps its value from being learned by eavesdropping. With HttpOnly, the page's JavaScript cannot read it, which reduces the damage if a session ID would otherwise be stolen through XSS. SameSite specifies, as Strict, Lax or None, whether the cookie is attached to requests started from other sites, and is one of the countermeasures against attacks that make a user send requests they did not intend.

Difference from localStorage

localStorage is also a mechanism for storing data in the browser, but its data is not attached to requests automatically; JavaScript reads and writes it. A cookie is small, generally up to about 4 KB each, and is sent with every request to its site, so putting large data in cookies increases traffic. Authentication information such as a session ID is generally put in an HttpOnly cookie that scripts cannot read.

Try it: questions about Cookie (HTTP cookie)

Which of the following correctly describes a difference between the browser's localStorage and cookies?

  1. AlocalStorage data is not attached to requests automatically; the JavaScript of pages of the same origin reads and writes it
  2. BlocalStorage data, like cookies, is put into a header and sent to the server automatically with every request to the same site
  3. ClocalStorage can also be given the HttpOnly attribute, so even if a session ID is stored there, the page's scripts cannot read it
Show answer and explanation

Answer: A. localStorage data is not attached to requests automatically; the JavaScript of pages of the same origin reads and writes it

localStorage is a storage area in the browser that keeps string keys and values per origin; it has no way to set an expiry and generally remains until deleted. It is not sent to the server automatically, so to send it, JavaScript puts it into a request. Cookies are small, generally up to about 4 KB each, and are sent automatically with every request, whereas larger data can be kept in localStorage. However, the page's JavaScript can read it at any time, so if there is an XSS flaw its contents can be stolen. This risk must be considered when storing values used for authentication.

FAQ

What happens if cookies are disabled?

Session IDs can no longer be passed, so many sites cannot keep you logged in. Information remembered in cookies, such as the contents of a shopping cart or display settings, is not kept either.

What are third-party cookies?

They are cookies set by a site other than the page you are viewing, such as a site that serves advertisements. Because they have been used to track users' behavior across many sites, some browsers do not send them by default or restrict them to protect privacy.

Cookie (HTTP cookie) in the explanations

Questions that mention Cookie (HTTP cookie) (6)

  1. Which of the following correctly describes the cookie set by the header above?
  2. Which of the following correctly describes a difference between the browser's localStorage and cookies?
  3. HTTP is a stateless protocol. Which of the following correctly describes what this means together with the usual way a website keeps a user logged in?
  4. A bulletin-board web application had a vulnerability in which scripts contained in text posted by users were executed in other visitors' browsers. Which combination correctly gives the name of this vulnerability and its fundamental countermeasure?
  5. A web application has a vulnerability in which, if a logged-in user opens a trap page prepared by an attacker, the user's browser sends requests to the legitimate site that the user did not intend, such as transferring money or changing settings. Which is an appropriate countermeasure?
  6. If a web application keeps using the same session ID before and after login, an attacker may get the user to use a session ID the attacker prepared in advance and then, after the user logs in, impersonate the user with that ID. What is the most appropriate countermeasure against this attack?

Books on Web Technology Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Cross-site scripting (XSS) HTTP (Hypertext Transfer Protocol) CORS (cross-origin resource sharing) DOM (Document Object Model) Event loop HTTP method HTTP status code JSON (JavaScript Object Notation) JWT (JSON Web Token) OAuth

Back to the glossary