Term
Glossary
Every term in alphabetical order, each with a plain-language definition.
Terms: 25
C
- CookieA cookie is a small named value that a browser stores at a server's request and sends back on matching later requests. It gives the state...
- Cookie headerThe Cookie header is the HTTP request header in which a browser returns the cookies that match a request. It carries only names and value...
- Cookie jarThe cookie jar is the browser's store of cookies, keyed by name, domain and path. Each browser profile keeps its own, so a private window...
- Cookie attributeA cookie attribute is an option written after the first semicolon of a Set-Cookie header, such as Path, Max-Age, Secure or SameSite. Attr...
- Cookie prefixA cookie prefix is a special start to a cookie's name, either __Secure- or __Host-, that makes supporting browsers enforce extra rules be...
- CSRFCSRF, or cross-site request forgery, is an attack in which a malicious page makes the victim's browser send an authenticated request to a...
D
E
F
H
- Host-only cookieA host-only cookie is a cookie set without a Domain attribute, so the browser returns it only to the exact host that set it. A cookie set...
- HttpOnlyHttpOnly is a cookie attribute that hides the cookie from page scripts, so document.cookie cannot read it, while the browser still sends ...
M
P
- PathThe Path attribute limits a cookie to requests whose URL path starts with the given value. Path=/admin covers /admin and /admin/users but...
- Persistent cookieA persistent cookie has an Expires or Max-Age attribute, so it survives browser restarts until that time passes or the user clears it. Ty...
- Partitioned cookieA partitioned cookie is a cookie stored separately for each top-level site, enabled by the Partitioned attribute as part of CHIPS (Cookie...
S
- Set-CookieSet-Cookie is the HTTP response header a server uses to create or update one cookie in the browser. It carries the cookie's name and valu...
- Session cookieA session cookie is a cookie with neither Expires nor Max-Age, so the browser treats it as temporary. It is meant to disappear when the b...
- SecureSecure is a cookie attribute that tells the browser to send the cookie only over encrypted connections, which in practice means HTTPS. MD...
- SameSiteSameSite is a cookie attribute that controls whether the cookie is sent on requests that start from another site. It has three values: St...
- SameSite StrictSameSite=Strict is a value under which the cookie is sent only on requests that start from the same site, even excluding navigations from...
- SameSite LaxSameSite=Lax is a value that withholds the cookie from most cross-site subrequests, such as images, frames and form posts, but allows it ...
- SameSite NoneSameSite=None is a value that allows the cookie on all requests, including cross-site ones. It is needed for legitimate cross-site uses s...
- Session fixationSession fixation is an attack in which the attacker sets a known session identifier in the victim's browser before the victim logs in, th...