Cookies and sessions are the twin pillars of stateful HTTP communication, enabling web applications to remember users across requests despite the protocol's inherently stateless nature. Cookies store small pieces of data in the browser that are automatically sent with every request, while sessions maintain server-side state tied to a unique identifier. Together, they power authentication flows, shopping carts, personalization, and user tracking—but also introduce significant security risks if misconfigured. Properly implementing cookie attributes (HttpOnly, Secure, SameSite), regenerating session IDs after privilege changes, and defending against attacks like session fixation and CSRF are non-negotiable for production systems. A well-configured cookie is the difference between a secure session and a hijacked one.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 117 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Cookie Fundamentals
| Concept | Example | Description |
|---|---|---|
Set-Cookie: sessionid=abc123; HttpOnly; Secure | • HTTP response header sent by server to browser instructing it to store a cookie • browser automatically includes cookie in subsequent requests to that domain. | |
Cookie: sessionid=abc123; user_pref=dark | • HTTP request header sent by browser to server containing all applicable cookies for that domain and path • automatically attached by browser. | |
username=john_doe | • Core cookie structure: name=value• name must be unique within its domain and path scope • value is typically URL-encoded. | |
Set-Cookie: temp=xyz | • Cookie with no Expires or Max-Age attribute• stored only in memory and deleted when browser closes or tab ends • used for temporary state. | |
Set-Cookie: token=def456; Max-Age=2592000 | • Cookie with explicit expiration time • survives browser restarts • stored on disk • used for "remember me" and long-term tracking. |