Cookies & Session Management Cheat Sheet

Updated 2026-05-25

Next Topic: Core Web Vitals and Performance Metrics Cheat Sheet

Cookies and sessions are the twin pillars of stateful HTTP communication, enabling web applications to remember users across requests despite the protocol's inherently stateless nature. Cookies store small pieces of data in the browser that are automatically sent with every request, while sessions maintain server-side state tied to a unique identifier. Together, they power authentication flows, shopping carts, personalization, and user tracking—but also introduce significant security risks if misconfigured. Properly implementing cookie attributes (HttpOnly, Secure, SameSite), regenerating session IDs after privilege changes, and defending against attacks like session fixation, CSRF, and JWT algorithm confusion are non-negotiable for production systems. A well-configured cookie is the difference between a secure session and a hijacked one.

What This Cheat Sheet Covers

This topic spans 22 focused tables and 148 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Cookie FundamentalsTable 2: Cookie AttributesTable 3: SameSite ValuesTable 4: Cookie PrefixesTable 5: Session Management PatternsTable 6: Session LifecycleTable 7: Session Storage StrategiesTable 8: Session Security ThreatsTable 9: CSRF Protection TechniquesTable 10: Session ID GenerationTable 11: Authentication Flow with SessionsTable 12: Session Timeout TypesTable 13: Cookie vs Token AuthenticationTable 14: Browser Storage OptionsTable 15: Distributed Session ManagementTable 16: Cookie and Session Best PracticesTable 17: Cookie Security PitfallsTable 18: Cookie Consent and PrivacyTable 19: Modern Cookie ChallengesTable 20: Framework-Specific Session HandlingTable 21: JWT Security Best PracticesTable 22: Advanced Session Security

Cookies are name-value pairs stored in the browser and automatically attached to every HTTP request for the matching domain and path. Understanding the two sides of this exchange—the Set-Cookie response header from the server and the Cookie request header from the browser—is the foundation of every authentication and session system on the web.

Concept	Example	Description
Set-Cookie header	`Set-Cookie: sessionid=abc123; HttpOnly; Secure`	• HTTP response header sent by server to browser instructing it to store a cookie • browser automatically includes cookie in subsequent requests to that domain.
Cookie header	`Cookie: sessionid=abc123; user_pref=dark`	• HTTP request header sent by browser to server containing all applicable cookies for that domain and path • automatically attached by browser.
Name-value pair	`username=john_doe`	• Core cookie structure: `name=value` • name must be unique within its domain and path scope • value is typically URL-encoded.
Session cookie	`Set-Cookie: temp=xyz`	• Cookie with no `Expires` or `Max-Age` attribute • stored only in memory and deleted when browser closes or tab ends • used for temporary state.
Persistent cookie	`Set-Cookie: token=def456; Max-Age=2592000`	• Cookie with explicit expiration time • survives browser restarts • stored on disk • used for "remember me" and long-term tracking.

Table 1: Cookie Fundamentals

Concept	Example	Description
Set-Cookie header	`Set-Cookie: sessionid=abc123; HttpOnly; Secure`	• HTTP response header sent by server to browser instructing it to store a cookie • browser automatically includes cookie in subsequent requests to that domain.
Cookie header	`Cookie: sessionid=abc123; user_pref=dark`	• HTTP request header sent by browser to server containing all applicable cookies for that domain and path • automatically attached by browser.
Name-value pair	`username=john_doe`	• Core cookie structure: `name=value` • name must be unique within its domain and path scope • value is typically URL-encoded.
Session cookie	`Set-Cookie: temp=xyz`	• Cookie with no `Expires` or `Max-Age` attribute • stored only in memory and deleted when browser closes or tab ends • used for temporary state.
Persistent cookie	`Set-Cookie: token=def456; Max-Age=2592000`	• Cookie with explicit expiration time • survives browser restarts • stored on disk • used for "remember me" and long-term tracking.