Cookies and sessions are the twin pillars of stateful HTTP communication, enabling web applications to remember users across requests despite the protocol's inherently stateless nature. Cookies store small pieces of data in the browser that are automatically sent with every request, while sessions maintain server-side state tied to a unique identifier. Together, they power authentication flows, shopping carts, personalization, and user tracking—but also introduce significant security risks if misconfigured. Properly implementing cookie attributes (HttpOnly, Secure, SameSite), regenerating session IDs after privilege changes, and defending against attacks like session fixation, CSRF, and JWT algorithm confusion are non-negotiable for production systems. A well-configured cookie is the difference between a secure session and a hijacked one.
What This Cheat Sheet Covers
This topic spans 22 focused tables and 148 indexed concepts, 97 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Cookie Fundamentals
Cookies are name-value pairs stored in the browser and automatically attached to every HTTP request for the matching domain and path. Understanding the two sides of this exchange—the Set-Cookie response header from the server and the Cookie request header from the browser—is the foundation of every authentication and session system on the web.
| Concept | Example | Description | |
|---|---|---|---|
Set-Cookie: sessionid=abc123; HttpOnly; Secure | • HTTP response header sent by server to browser instructing it to store a cookie • browser automatically includes cookie in subsequent requests to that domain. | ||
Cookie: sessionid=abc123; user_pref=dark | • HTTP request header sent by browser to server containing all applicable cookies for that domain and path • automatically attached by browser. | ||
username=john_doe | • Core cookie structure: name=value• name must be unique within its domain and path scope • value is typically URL-encoded. | ||
Set-Cookie: temp=xyz | • Cookie with no Expires or Max-Age attribute• stored only in memory and deleted when browser closes or tab ends • used for temporary state. | ||
Set-Cookie: token=def456; Max-Age=2592000 | • Cookie with explicit expiration time • survives browser restarts • stored on disk • used for "remember me" and long-term tracking. | ||
Set by example.com on example.com | • Cookie set by the domain the user is visiting • used for authentication, preferences, and functional state • not blocked by default. | ||
Set by tracker.com on example.com | • Cookie set by a different domain (embedded script or iframe) than the visited site • used for cross-site tracking and ads • increasingly blocked by browsers in 2026. | ||
Domain=.example.com; Path=/shop | • Defines which domains and URL paths receive the cookie • controls visibility and prevents leakage to unrelated subdomains. | ||
document.cookie = "theme=dark; path=/";let all = document.cookie; | • JavaScript API for reading and writing cookies on client side • cannot access HttpOnly cookies• requires manual string parsing. | ||
await cookieStore.set({name: "theme", value: "dark"});let c = await cookieStore.get("theme"); | • Modern asynchronous API for cookie management • cleaner than document.cookie• supports change listeners • limited browser support as of 2026. |