HTTP Cookie

Guide

Guides

Longer explanations to read when a short definition is not enough.

Guides: 8

  1. How the Set-Cookie and Cookie Headers WorkA plain walkthrough of how a server sets a cookie with Set-Cookie and how the browser sends it back with the Cookie header on later requests.
  2. Domain, Path, Expires and Max-Age ExplainedLearn how the Domain, Path, Expires and Max-Age cookie attributes decide where a cookie is sent and how long it lives, with common mistakes to avoid.
  3. Secure, HttpOnly and the __Host- and __Secure- PrefixesWhat the Secure and HttpOnly flags protect against, and how the __Host- and __Secure- cookie name prefixes make browsers enforce stricter rules for you.
  4. SameSite Strict, Lax and None ExplainedUnderstand the SameSite cookie attribute, the difference between Strict, Lax and None, and why cross-site requests sometimes arrive without your cookie.
  5. First-Party, Third-Party and Partitioned CookiesHow first-party and third-party cookies differ, why browsers limit the latter, and what the Partitioned attribute (CHIPS) is meant to do in general terms.
  6. Sessions vs Tokens: Where Cookies FitCompare server-side sessions and signed tokens such as JWT, when to keep them in cookies, why storage choice matters, and how to log out safely.
  7. Debugging Cookies in Browser Developer ToolsA practical routine for finding out why a cookie was not set, not sent or not deleted, using the network and application panels of browser developer tools.
  8. Cookies, CSRF, XSS and Privacy Consent BasicsHow cookies relate to CSRF and XSS attacks, plus a general, non-legal overview of consent ideas under GDPR, ePrivacy and India's DPDP Act.