Cookie
A small piece of data stored in the user's browser that is sent with every HTTP request to the server that set it, used for maintaining state and tracking.
Detailed Explanation
Cookies are the oldest and most universal mechanism for maintaining state in web applications. When a server sets a cookie (via the Set-Cookie header), the browser stores it and includes it in all subsequent requests to that domain. Cookies are commonly used for session IDs, authentication tokens, user preferences, and analytics tracking.
Cookies have several security attributes: Secure (HTTPS only), HttpOnly (not accessible via JavaScript), SameSite (CSRF protection), and domain/path restrictions. Understanding cookie behavior is essential for implementing authentication, managing user state, and complying with privacy regulations.
Why It Matters
Cookies are fundamental to web authentication and state management. Understanding their behavior, security attributes, and limitations is essential for any web developer.
Real-World Example
When you check "Remember me" on a login form, the server sets a persistent cookie with a secure token. The browser sends this cookie on subsequent visits, keeping you logged in for days or weeks.
When to Use
For storing session IDs, authentication tokens (HTTP-only cookies), user preferences, and tracking. Cookies are sent automatically by the browser with every request.
Advantages
- Automatically sent with every request
- Browser handles storage and transmission
- Supports expiry and persistence
- Secure flags available (Secure, HttpOnly, SameSite)
- Works across tabs and windows
Disadvantages
- Limited to ~4KB per cookie
- Sent with every request (overhead)
- Vulnerable to CSRF if not properly configured
- Third-party cookies are being phased out
- Subject to browser privacy restrictions
Related Terms
Frequently Asked Questions
What is the difference between cookies and local storage?
Cookies are sent with every HTTP request and have security attributes (Secure, HttpOnly, SameSite). Local storage is only accessible via JavaScript and is not sent with requests. Use cookies for auth; use local storage for client-side data.
How do I set a secure cookie?
Set these attributes: Secure (HTTPS only), HttpOnly (no JavaScript access), SameSite=Strict or Lax (CSRF protection), and appropriate Domain and Path. In Express: res.cookie("name", "value", { secure: true, httpOnly: true, sameSite: "strict" }).
Are cookies going away?
Third-party cookies (used for cross-site tracking) are being phased out by browsers. First-party cookies (set by the site you are visiting) remain essential for authentication and will continue to work.
How do cookies relate to GDPR?
GDPR requires consent before setting non-essential cookies (analytics, marketing). Essential cookies (session, auth) are exempt. Cookie consent banners must allow users to reject non-essential cookies easily.
Can cookies be stolen?
If not properly secured, cookies can be stolen through XSS (if not HttpOnly), network interception (if not Secure), or CSRF attacks (if not SameSite). Always use all three security flags.