4. HTTP Cookies
A cookie is a piece of data that is issued by a server in an HTTP response and stored for future use by the HTTP client. The client then re-supplies the cookie value in subsequent requests to the same server. This mechanism allows the server to store user preferences and identify individual users.
4.1 Setting Cookies
Servers supply cookies by adding a set-cookie response header for each cookie. For example, if you use Example 4 below to create a cookie called theme with the value dark that lasts for a year, www.httpwatch.com returns this header:
set-cookie: theme=dark; expires=Wed, 13 Oct 2027 11:03:20 GMT; path=/httpgallery/cookies/The header starts with the name and value of the cookie, followed by optional attributes that control how it is stored and when it is sent back to the server. A cookie that keeps a user signed in would normally use more attributes to protect it, e.g.:
set-cookie: session=8f3a61c2e9; path=/; secure; samesite=lax; httponlyThe attribute names are not case sensitive. These are the attributes that can be used:
Name=Value |
The name of the cookie and the textual value it holds. |
Expires / Max-Age |
When the cookie should be discarded by the browser, either as a date/time (Expires) or as a number of seconds from now (Max-Age). If neither is set, the cookie is a session cookie that is discarded when the browser session ends. Setting a date/time in the past (or Max-Age=0) deletes a cookie. |
Path |
The path below which the cookie should be supplied by the browser. |
Domain |
If set, the cookie is also sent to subdomains of this domain. If omitted, the cookie is only sent to the host that set it. |
Secure |
The cookie is only sent over HTTPS connections. |
HttpOnly |
The cookie cannot be read by JavaScript using document.cookie. This helps protect session cookies from being stolen by a cross-site scripting (XSS) attack. |
SameSite |
Controls whether the cookie is sent with requests from other sites: Strict (never), Lax (only when the user navigates to this site) or None (always, but only if Secure is also set). Browsers such as Chrome and Edge treat cookies without this attribute as Lax. |
Partitioned |
Stores a separate copy of a cookie used in embedded third-party content for each top-level site, so it cannot be used to track users across sites. |
These attributes allow a server to create, modify, delete, and control which requests will include the cookie. Cookies can also be created and read by JavaScript running in the page using document.cookie or the newer cookieStore API.
4.2 Retrieving Cookies
Whenever a client is about to make an HTTP request it consults its local cookie store to see if any unexpired cookies match the domain, path and other attributes of the request. Any matching cookie values are submitted back to the server using the cookie request header. For example, after creating the cookie above, Chrome sends this header when it requests this page:
cookie: _ga=GA1.1.123456789.1781623674; _ga_EZJNXG1Z1J=GS2.1.s1791888846$o35$g1$t1791888867$j39$l0$h0; theme=darkThe two _ga cookies were not set by a set-cookie header. They were created by the Google Analytics script on this site using JavaScript, but they are sent to the server in the same way.
Only the names and values are sent back; the server cannot see the attributes that were used to set each cookie.
4.3 Third-Party Cookies
Cookies set by the site shown in the address bar are known as first-party cookies. Cookies set by content from other sites embedded in the page, such as adverts or analytics scripts, are third-party cookies and have often been used to track users across sites. For this reason many browsers block or restrict third-party cookies by default, or let users choose to block them.
Example 4
Using HttpWatch with Example 4
To view the use of cookies on this page:
- Open HttpWatch by pressing Ctrl+Shift+H, clicking the HttpWatch icon on the browser toolbar, or right-clicking the page and selecting HttpWatch
- Click on Record to start logging requests in HttpWatch
- Use the form above to create or edit cookies for this page
- Optional: You can add a filter to only capture access to this page by adding a 'URL contains' condition with the value "cookies/"
- To view cookies for this page, select its entry in the HttpWatch log and go to the Cookies tab. It shows the cookies that were sent and received, together with their attributes, and can also show cookies set by JavaScript and cookies that were blocked by the browser