Overview
Cookies are small pieces of data a server stores in the browser and that the browser sends back on subsequent requests. They are how the stateless web remembers you — and they are central to session security. This lesson introduces cookies.
Learning objectives
- Explain what a cookie is and how it is set and sent.
- Describe the purpose of cookies in web applications.
- Recognize cookies as a security-sensitive element.
Core concept
A cookie is a name/value pair a server sends with the Set-Cookie response header; the browser stores it and automatically includes it in the Cookie header on future requests to that site. Because HTTP is stateless (each request is independent), cookies let a site associate requests with a returning user — most importantly to maintain a login session.
Cookies can carry attributes (scope, lifetime, and security flags) covered in a later lesson.
How it works
After you log in, the server typically issues a session cookie (via Set-Cookie). The browser then attaches that cookie to every subsequent request to the site, so the server recognizes you without re-authenticating each time. The cookie's attributes control where and how it is sent (which domain/path, whether only over HTTPS, whether scripts can read it). Because the browser sends cookies automatically, they are both convenient and a target for theft or abuse.
Practical example
You log into a site; the response includes Set-Cookie: session=<value>; HttpOnly; Secure. From then on, your browser automatically sends Cookie: session=<value> with each request, and the server knows it is you. If that cookie value were stolen, an attacker could impersonate your session — which is why protecting cookies (with the flags in the upcoming lesson) is critical.
Cybersecurity relevance
Cookies most often hold session identifiers, making them a prime target: stealing a session cookie can mean session hijacking (impersonating a logged-in user). Threats include theft via XSS (if scripts can read the cookie), interception over plain HTTP, and cross-site sending. The protective flags (HttpOnly, Secure, SameSite) and good session management (later lessons) exist precisely to defend cookies. Understanding cookies is the foundation for session security.
Common mistakes
- Storing sensitive data directly in cookies rather than an opaque session identifier.
- Forgetting cookies are sent automatically, which underlies CSRF (covered later).
- Overlooking cookie protection flags, leaving session cookies exposed.
Key takeaways
- A cookie is server-set data (
Set-Cookie) stored in the browser and sent back automatically (Cookie) on later requests. - Cookies give the stateless web memory, most importantly to maintain login sessions.
- Cookies commonly hold session identifiers and are a theft target; protective flags and sound session management defend them.
Check your understanding
- How does a cookie let a stateless web application remember that you are logged in?
- Why is a cookie that holds a session identifier a valuable target for attackers?