Cookies

Overview

A cookie is a small block of data created by a web server and placed on a client device. It consists of a name, a value, and zero or more attributes (e.g. Secure and HttpOnly).

Browsers automatically send cookies issued by a domain to any request matching the domain. This particular "feature" is the root for a number of privacy concerns (e.g. third-party cookies) and security concerns (e.g. XSS cookie theft).

Lifetimes

A session cookie is a cookie that only exists temporarily while the user navigates a website. They expire or are deleted when the web browser determines a session is complete (e.g. when the browser is closed).

In contrast, a persistent cookie is one that expires at a specific date or after a specific length of time. A cookie is considered persistent if either the Expires or Max-Age attributes are set.

Attributes

HttpOnly

The HttpOnly attribute indicates that a browser cannot expose cookies through channels other than HTTP(S). Notably, JavaScript cannot access these cookies.

SameSite

The SameSite attribute dictates when cookies should be sent to the target site. There exist three possible values:

1. Strict. Indicates the browser only sends cookies to a target site that is the same as the origin site.
2. Lax. Indicates the browser may send cookies with requests to a target site different from the origin site if the request is deemed safe.
3. None. Indicates no restriction, i.e. allows cross-site cookies.

Secure

The Secure attribute indicates that a browser should only send a cookie over secure/encrypted connections. For example, only over HTTPS connections.