HTTP Cookie
A small piece of state a server asks the browser to store and send back on later requests, governed by attributes that decide exactly where it goes.
An HTTP cookie is a small name–value pair a server sets with a Set-Cookie response header, which the browser then attaches to later requests that match the cookie's scope. Cookies are how stateless HTTP carries sessions: the server issues an identifier once, and the browser sends it back automatically.
That "automatically" is the source of both their convenience and their danger, and the attributes exist to narrow it:
Domain. Omitted, the cookie is host-only and goes to exactly the host that set it. Set, it goes to that domain and every subdomain. A host-only cookie set byapp.example.comis not visible ontenant.app.example.com, a frequent source of "logged in here but not there" bugs in multi-tenant apps on subdomains. A leading dot (.example.com) is ignored in the header today, but some programmatic interfaces, including browser automation protocols, still use it as the marker for a domain cookie versus a host-only one. Leaving it out there quietly creates a cookie that never matches.Pathnarrows by URL path. It is not a security boundary.Securerestricts the cookie to HTTPS.HttpOnlyhides it from JavaScript, so a Cross-Site Scripting bug cannot read the session token.SameSitecontrols whether the cookie is sent on requests initiated by other sites.Strictnever,Lax(the default in Chromium browsers) only on top-level navigations,Nonealways (which requiresSecure). It is the main modern defense against Cross-Site Request Forgery.- Prefixes. A name beginning
__Host-is accepted only if it isSecure, host-only, andPath=/, so a compromised subdomain cannot overwrite it.
Most cookie failures are silent. A cookie with an invalid domain, a missing Secure on a SameSite=None cookie, or a size over the ~4 KB limit is simply dropped, with no error in the page, only a console warning if anyone is looking. The symptom is a redirect to login or a 401 several steps later. When authentication "randomly" fails on one host, the first check is the stored cookie in the browser's storage panel: its domain, path, and flags.
Cookies compete with bearer tokens such as a JSON Web Token in a header. Header tokens aren't sent automatically, so they are immune to CSRF, but they have to be stored somewhere JavaScript can read, which exposes them to XSS. The trade-off sits between the two attack classes.
See also6
Session Management
How a website remembers that a visitor has signed in across otherwise unrelated requests, usually with a random identifier in a cookie, and the attacks that target that identifier.
Web Platform11 connections
Internationalized Domain Name
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
Web Platform10 connections
Referrer Policy
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
Web Platform12 connections
Web Storage
The browser's built-in ways to keep data on the user's device, from the simple string store localStorage to the transactional database IndexedDB, and their limits on size, persistence and security.
Web Platform12 connections
Web Analytics
Measuring how people use a website, from parsing server logs to JavaScript page tags and Google's free Analytics, with metrics like pageviews and bounce rate that are distorted by bots, blockers, and consent rules and easy to optimize in the wrong direction.
Web Platform11 connections
Clickjacking
Tricking a user into clicking something on another site by loading it invisibly in a frame beneath a decoy, and the headers that stop a page from being framed.
Web Platform9 connections
Linked from12
- ClickjackingWeb Platform
Tricking a user into clicking something on another site by loading it invisibly in a frame beneath a decoy, and the headers that stop a page from being framed.
- Cross-Site Request ForgeryWeb Platform
Tricking a logged-in user's browser into sending a state-changing request to another site, which works because the browser attaches that site's cookies automatically.
- Internationalized Domain NameWeb Platform
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
- JSON Web TokenWeb Platform
A signed, self-contained token that carries claims a server can verify without a database lookup.
- Multi-TenancyData & Content
One deployment serving many isolated customers, with tenancy threaded through data, routing, and access.
- Packet CaptureNetworks & Distribution
Recording the raw packets crossing a network interface for inspection, the debugger of networking, done with tools like tcpdump and Wireshark and limited mainly by encryption and switched networks.
- Personal DataData & Content
Any information that relates to an identifiable person, why it is broader than names and emails, and the engineering habits that privacy law now expects.
- Referrer PolicyWeb Platform
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
- Same-Origin PolicyWeb Platform
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
- Session ManagementWeb Platform
How a website remembers that a visitor has signed in across otherwise unrelated requests, usually with a random identifier in a cookie, and the attacks that target that identifier.
- Web AnalyticsWeb Platform
Measuring how people use a website, from parsing server logs to JavaScript page tags and Google's free Analytics, with metrics like pageviews and bounce rate that are distorted by bots, blockers, and consent rules and easy to optimize in the wrong direction.
- Web StorageWeb Platform
The browser's built-in ways to keep data on the user's device, from the simple string store localStorage to the transactional database IndexedDB, and their limits on size, persistence and security.