Cookie

A cookie is a small piece of data that a website stores in a user’s browser. It is used to store information about a session, preferences, authorization, and user behavior on the site. Thanks to cookies, websites “remember” users — for example, they don’t require logging in again on the next visit.

What is a Cookie

Cookies are text files containing key-value pairs.
They are sent by the server to the browser during the first visit to a website and are then sent back to the server with each subsequent request to that site.

Example of cookie content:

text

session_id=84af7b2d; user=alex; theme=dark; expires=Wed, 10 Dec 2025 12:00:00 GMT

The browser stores this data locally and automatically adds it to the HTTP request header so the site can identify the user.

Why Cookies Are Needed

• Authorization and sessions. Cookies allow a site to “recognize” a logged-in user so it doesn’t ask for login credentials again.
• User preferences. For example, interface language, selected theme, or shopping cart contents in an online store.
• Analytics and statistics. Cookies help systems like Google Analytics collect data on user behavior.
• Advertising personalization. Marketing platforms use cookies to show relevant ads.
• Security. Some cookies are used to protect sessions from forgery (e.g., HttpOnly and SameSite).

Types of Cookies

How Cookies Work

1. User opens a website.
2. Server returns an HTTP header Set-Cookie:
3. text
4. Set-Cookie: user=alex; Expires=Tue, 01 Dec 2025 12:00:00 GMT; Path=/; Secure; HttpOnly
5. Browser saves this file.
6. On the next request, the browser adds the header:
7. text
8. Cookie: user=alex
9. Server reads the data and recognizes it’s the same user.

Example: Setting Cookies with JavaScript

javascript

// Set a cookie

document.cookie = “theme=dark; path=/; max-age=86400”;

// Read cookies

console.log(document.cookie);

// Delete a cookie

document.cookie = “theme=; path=/; max-age=0”;

Here, max-age=86400 means a lifetime of 24 hours (in seconds).

How Websites Use Cookies

• Online stores — remember shopping cart contents and browsing history.
• Banking applications — maintain secure user sessions.
• Social networks — keep users logged in.
• Advertising networks — track interests for personalized ad displays.
• Analytics — collect anonymized data on visits.

Security and Privacy

Cookies cannot directly execute code or transmit viruses, but they can contain sensitive data. Therefore, it’s important to:

• Transmit cookies only over HTTPS (Secure).
• Disable access via JavaScript (HttpOnly).
• Limit the scope (Path, Domain).
• Set the SameSite=Lax or Strict attribute to protect against CSRF attacks.

Modern browsers also block third-party cookies by default to reduce user tracking.

Cookies and GDPR / Data Protection Laws

According to GDPR (General Data Protection Regulation) and data protection laws (e.g., Russia’s Federal Law №152-FZ), websites must:

• Notify users about cookie collection.
• Obtain consent for using analytical and advertising cookies.
• Provide an option to opt out.

This is why you often see banners like: “We use cookies to improve your experience. Do you agree?”

Alternatives to Cookies

Modern technologies partially replace cookies:

• LocalStorage and SessionStorage — store data in the browser but are not sent to the server.
• IndexedDB — a browser database for complex applications.
• Server-side sessions — store session data on the server, with only an access key in the cookie.

How to View Cookies

• In Chrome/Edge: F12 → Application → Storage → Cookies.
• In Firefox: Developer Tools → Storage.
• In Safari: Preferences → Privacy → Manage Website Data.

Example: What a Cookie File Looks Like

Conclusion

Cookies are a key web mechanism that enables saving individual settings, maintaining authorization, and personalizing content. At the same time, it’s crucial to balance convenience with privacy.