What Are Cookies?

Cookies are small text files that web servers send to a user’s web browser, which stores them on the client’s device. These files contain data that help websites remember information about users, such as login status, preferences, or tracking identifiers.

Cookies were introduced in the early 1990s to address the challenge posed by the HTTP protocol’s statelessness — meaning that each request to a server is independent and does not inherently carry information about previous interactions. Cookies allow websites to “remember” users and their interactions across sessions.

Each cookie consists of key-value pairs and a set of metadata that define the cookie’s scope, lifespan, and security properties. The browser automatically includes relevant cookies in subsequent HTTP requests to the appropriate domains, enabling servers to maintain a continuous user experience.

Major Use Cases of Cookies

Cookies are vital across many web application domains due to their ability to persist state and track information. Below are key use cases:

1. Session Management

Cookies enable websites to identify returning users and maintain session continuity without requiring users to authenticate on every page load. For example, after logging in, a session cookie keeps a user logged in until they log out or the session expires.

2. User Preferences and Personalization

Cookies store user settings such as language preferences, theme choices, or layout configurations. When a user revisits, the site can retrieve these preferences and tailor the interface accordingly.

3. Shopping Cart Persistence

E-commerce websites leverage cookies to remember products added to a user’s cart even if the browser is closed and reopened before checkout, enhancing the shopping experience.

4. Tracking and Analytics

Cookies collect data on user behavior, page visits, and navigation paths. Analytics platforms use cookies to generate insights about website performance and user engagement. Advertising networks use third-party cookies to track users across sites for targeted ads.

5. Security

Cookies help secure web applications by storing tokens or flags used in authentication workflows, CSRF protection, and managing user permissions.

6. Legal Compliance

Cookies assist in storing consent information, ensuring compliance with data protection regulations like the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

How Cookies Work Along with Architecture

Cookies operate at the intersection of HTTP protocol, client (browser) storage, and server-side application logic. The architecture supporting cookie functionality includes several components:

1. HTTP Headers and Communication

• When a client sends a request to a server, it includes a Cookie header containing cookies relevant to the request URL’s domain and path.
• The server can send back one or more Set-Cookie headers in its response to instruct the browser to store new cookies or update existing ones.

Example HTTP response header:

Set-Cookie: sessionId=abc123; Expires=Wed, 09 Jun 2026 10:18:14 GMT; Path=/; Secure; HttpOnly; SameSite=Strict

2. Browser Cookie Storage

• Browsers maintain a “cookie jar” storing cookies by domain and path.
• They enforce scoping rules, ensuring cookies are only sent to appropriate URLs.
• Cookies are stored on disk or in memory depending on persistence.

3. Cookie Attributes and Their Impact

• Domain: Restricts the domains to which the cookie will be sent. Cookies set for example.com are sent to sub.example.com but not to otherdomain.com.
• Path: Restricts the URL paths on the domain for which the cookie is valid.
• Expires/Max-Age: Defines when a cookie will be deleted. Session cookies expire when the browser closes; persistent cookies survive beyond sessions.
• Secure: Ensures cookies are only sent over HTTPS connections.
• HttpOnly: Prevents client-side JavaScript from accessing cookies, mitigating some XSS attacks.
• SameSite: Controls cross-site cookie sharing to prevent CSRF and privacy leaks. Values include Strict, Lax, or None.

4. Server-Side Handling

• Servers read cookies from incoming requests and use their data to maintain sessions, authenticate users, or track state.
• Servers can update or delete cookies by sending updated Set-Cookie headers.

5. Third-Party Cookies

• These are cookies set by domains other than the one shown in the browser’s address bar, typically used by advertisers or analytics services.
• Modern browsers are increasingly restricting third-party cookies due to privacy concerns.

Detailed Workflow of Cookies

1. Initial Visit

• User visits a website; the browser sends a request without cookies.

2. Server Response with Cookies

• Server responds with Set-Cookie headers to establish sessions or preferences.

3. Browser Stores Cookies

• The browser saves cookies respecting domain, path, security attributes.

4. Subsequent Requests

• Browser automatically includes relevant cookies in HTTP requests for that domain/path.

5. Server Processes Cookies

• Server uses cookies to authenticate the user, retrieve session data, or customize the response.

6. Cookie Updates

• Server can update cookies by sending new Set-Cookie headers with modified values or expiration.

7. Cookie Expiration or Deletion

• Cookies expire naturally after their expiry time or are deleted by explicit instructions or user actions.

Step-by-Step Getting Started Guide for Cookies

Step 1: Understand Cookie Fundamentals

Familiarize yourself with cookie components — name, value, domain, path, expiry, and security flags.

Step 2: Setting Cookies from the Server

Example: Node.js Express

res.cookie('userId', '12345', {
  maxAge: 24 * 60 * 60 * 1000, // 1 day
  httpOnly: true,
  secure: true,
  sameSite: 'Strict',
  path: '/'
});

Step 3: Reading Cookies on Server

Using the cookie-parser middleware:

const userId = req.cookies.userId;
console.log(`User ID from cookie: ${userId}`);

Step 4: Creating Cookies with JavaScript

document.cookie = "theme=dark; max-age=3600; path=/";

Step 5: Deleting Cookies

Set expiration date in the past:

document.cookie = "theme=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";

Step 6: Implement Security Best Practices

• Always set HttpOnly and Secure flags where possible.
• Use SameSite attributes to reduce CSRF vulnerabilities.
• Avoid storing sensitive information directly in cookies.

Step 7: Respect Privacy Regulations

• Implement consent banners.
• Provide users with options to manage cookie preferences.
• Document cookie usage in privacy policies.

Advanced Topics and Considerations

1. Cookie Size and Limits

• Most browsers limit individual cookie size to 4KB.
• There is a per-domain cookie limit (around 20–50 cookies).
• Exceeding limits causes older cookies to be evicted.

2. Third-Party Cookie Restrictions

• Browsers increasingly block or restrict third-party cookies.
• Alternatives include localStorage, IndexedDB, or server-side sessions.

3. Alternatives to Cookies

• Web Storage API (localStorage, sessionStorage) for client-side storage.
• JWT tokens for stateless authentication.

4. Cross-Origin Resource Sharing (CORS) and Cookies

• Cookies require careful configuration of CORS headers and credentials policies to work across domains.

The post Understanding Cookies: Concepts, Use Cases, Architecture and Getting Started appeared first on scmGalaxy.

Cookies are little text files that websites save on the user’s device (such as a computer or mobile device) when the user visits the website. These files include information that the website may download and utilize the next time the visitor visits the site.

HTTP cookies are required for modern Internet use, yet they compromise your privacy. HTTP cookies, which are a required aspect of online browsing, assist web developers in providing you with more personalized, easy website visits. Websites may remember you, your website logins, shopping carts, and other information via cookies. They may, however, be a goldmine of private information for crooks to snoop on.

Different types of cookies – Magic Cookies and HTTP Cookies

Magic cookies :- The term “magic cookies” originated in the early days of computers and describes data packets that are delivered and received unchanged. This is frequently used to enter into computer databases, such a company’s internal network. The term “cookie” as we know it today predates this concept.

HTTP cookies :- HTTP cookies are a modified form of the “magic cookie” designed for web browsing. The “magic cookie” inspired web browser creator Lou Montulli in 1994. When he assisted a website for online shopping in repairing its overburdened servers, he duplicated this idea for browsers.

What Are Cookies Used For?

Websites utilize HTTP cookies to improve the user experience. Without cookies, you would have to log back in each time you left a website or, if you accidently closed the browser, rebuild your shopping cart. making cookies a crucial component of using the internet.

Session management :- Transient cookies and per-session cookies are other names for session cookies. While a person is browsing a website, session cookies save data. Once the user ends the session, these cookies are removed.

Persistent cookie :- Cookies that are persistent are kept for a certain period of time. Until they are erased or they expire, these cookies stay on your device. Because they are used to gather user data including browsing patterns and preferences, persistent cookies are also known as tracking cookies.

First-party and third-party cookies :- Cookies that are set by websites that users visit directly are known as first-party cookies. These cookies typically store data relevant to or related with the website, such as user preferences or location.
Cookies that are associated with third-party content, such as embedded videos, advertisements, web banners, and scripts, are referred to as third-party cookies. Third-party cookies are frequently used by advertisers to monitor user behaviour.

Tracking :- Shopping sites use cookies to keep track of the items that users have previously viewed, allowing the sites to propose more things that they may be interested in and store products in their shopping carts while customers browse elsewhere.

Conclusion

Unsecured cookies may potentially provide a security risk to website owners and users. The original website or a third party receives unencrypted data about an insecure cookie over HTTP. That’s a low danger if the information is something straightforward, like if the person has already visited the site. Some websites, however, may use cookies to store user data, including personally identifying information such as login passwords and payment card details. Unencrypted transmissions of such kind of data leave them open to interception and misuse by criminals. A secure cookie only permits the transmission of cookie data via HTTPS and does not carry the same danger.

The post What is Cookies and Why it is Used? appeared first on scmGalaxy.

When we assign a new cookie value to document.cookie, the current cookie is not replaced. The new cookie is parsed and its name-value pair is appended to the list. The exception is when you assign a new cookie with the same name (and same domain and path, if they exist) as a cookie that already exists. In this case, the old value is replaced with the new.

Reading Cookie

We can read cookies by a document.cookie. The problem occurs when we need the specific part of the cookie to perform some action.

Deleting Cookies

A cookie is deleted by setting a cookie with the same name (and domain and path, if they were set) with an expiration date in the past and if using max-age then must set a negative value.

Ex: –

Updating Cookies

A cookie is possible to update by setting a new value to a cookie with the same name.

Cookies Security Issues

• Can misuse Client Details
• Can track User
• Client Can Delete Cookies
• Client can Manipulate Cookies

Cookies Limitation

• Support HTML4 / HTML 5
• Each cookie can contain 4kb Data
• Cookies can be stored in Browser and server
• It is sent with each request

The post Replace/Append Cookies in JavaScript appeared first on scmGalaxy.

Cookies are exposed as the cookie property of the Document object. This property is both readable and writeable.

You can see Cookies in Google Chrome by following chrome://settings/content/cookies

Creating Cookies

When you assign a string to document.cookie, the browser parses it as a cookie and adds it to its list of cookies. There are several parts to each cookies, many of them optional.

Syntax: –

document.cookie = “name=value”;
document.cookie = “name=value; expires=date; domain=domain; path=path; secure”;
document.cookie = “name=value; max-age=inSecond; domain=domain; path=path; secure”;

Ex:-

Creating Cookies

Optional Cookies Attribute:-

max-age
expires
domain
path
secure

Whenever you omit the optional cookie fields, the browser fills them in automatically with reasonable defaults.

max-age

It is used to create persistent cookies. It is supported by all modern browsers except IE.

Type of cookies: –

• Session Cookies – Cookies that are set without the expires/max-age field are called session cookies. It is destroyed when the user quits the browser.
• Persistent Cookies – The browser keeps it up until their expiration date is reached.

Ex:-

expires

It is used to create persistent cookies.

Type of cookies: –

• Session Cookies – Cookies that are set without the expires/max-age field are called session cookies. It is destroyed when the user quits the browser.
• Persistent Cookies – The browser keeps it up until their expiration date is reached.

Ex:-

document.cookie = “username=devops; expires=Monday, 3-Sep-2018 09:00:00 UTC”;

domain

It specifies the domain for which the cookie is valid. If not specified, this defaults to the host portion of the current document location. If a domain is specified, subdomains are always included.

Ex: –

path

Path can be / (root) or /mydir (directory). If not specified, defaults to the current path of the current document location, as well as its descendants.

Ex: – document.cookie = “username=devops; path=/”;

Ex: – document.cookie = “username=devops; path=/home”;

secure

Cookie to only be transmitted over secure protocol as https. Before Chrome 52, this flag could appear with cookies from http domains.

Ex: – document.cookie = “username=devops; secure”;

The post How many create cookies in JavaScript? appeared first on scmGalaxy.

A cookie is a small piece of text data set by the Web server that resided on the client’s machine. Once it’s been set, the client automatically returns the cookie to the webserver with each request that it makes. This allows the server to place values it wishes to ‘remember’ in the cookie, and have access to them when creating a response.

How Cookie Works

How Cookie Works

How Cookie Works

How Dangerous Cookies are

Type of Cookies

• Session Cookies – Cookies that are set without the expires field are called session cookies. It is destroyed when the user quits the browser.

• Persistent Cookies – The browser keeps it up until their expiration date is reached.

The post What are cookies in JavaScript? appeared first on scmGalaxy.