Cookies
HTTP forgets you the instant a request ends. Cookies are the small notes that let a site remember who you are.
HTTP is stateless — each request stands alone, and the server has no built-in memory of the last one. Cookies fix that: the server hands the browser a small piece of data, and the browser sends it back on every subsequent request.
How they are set
The server includes a header in its response:
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax; Max-Age=3600From then on the browser automatically attaches it:
Cookie: session=abc123The important attributes
| Attribute | Effect |
|---|---|
HttpOnly | JavaScript cannot read it — blocks theft via XSS. |
Secure | Only sent over HTTPS. |
SameSite | Controls whether it is sent on cross-site requests — the main CSRF defense. |
Max-Age / Expires | How long it lives. Without them it is a “session” cookie and vanishes when the browser closes. |
Domain / Path | Which requests the cookie is attached to. |
Sessions
A login usually works like this: you sign in, the server creates a session and stores it, and gives you a cookie holding only an opaque session ID. The real data stays on the server; the cookie is just the claim ticket. Because it identifies you, a stolen session cookie is as good as your password — which is why HttpOnly and Secure matter.
Cookies, localStorage, and tokens
- Cookies — sent automatically with every request; good for sessions.
- localStorage — stays in the browser, never sent automatically; read by JavaScript.
- JWTs — signed tokens that can live in either, carrying claims the server can verify without a lookup.