Skip to main content

Cookies and their types

Short answer

A cookie is a small text piece the server sets via Set-Cookie to maintain state across stateless HTTP requests. Types include session (browser-close deletion), persistent (expiry date), first-party vs third-party (tracking), and security-oriented Secure/HttpOnly cookies.

What is cookie? What are the types of cookie? Explain.

What is a cookie?

A cookie is a small piece of text data (name=value, up to about 4 KB) that a web server sends to the browser, which stores it and returns it with later requests to the same site. HTTP is stateless, so cookies let a site remember users: login sessions, shopping carts, preferences and tracking.

Four components

  1. Set-Cookie: header in the HTTP response.
  2. Cookie: header in later HTTP requests.
  3. Cookie file kept by the user's browser.
  4. A back-end database at the web site that links the cookie ID to user data.
 Browser                         Server
   |-- GET /home ---------------->|
   |<- 200 OK, Set-Cookie: id=1678|  (server creates DB entry 1678)
   |-- GET /cart, Cookie: id=1678>|  (server recognises user)

Attributes: Expires/Max-Age, Domain, Path, Secure, HttpOnly, SameSite.

Types of cookies

By lifetime

  • Session (transient) cookies: no expiry date; kept in memory and deleted when the browser closes. Used for login sessions and carts.
  • Persistent cookies: have an expiry date; saved on disk and survive restarts. Used for "remember me" and preferences.

By origin

  • First-party cookies: set by the site the user is visiting.
  • Third-party cookies: set by another domain (advertisers, analytics, embedded content), used to track users across sites. Many browsers now block them.

By purpose or security

  • Secure cookies: sent only over HTTPS.
  • HttpOnly cookies: not readable by JavaScript, reducing XSS theft.
  • Tracking / advertising cookies, authentication cookies, and supercookies / zombie cookies (hard to delete) are further categories.

Privacy concern: cookies can build profiles of users, so users can control or delete them in browser settings.

✓ Answer checked by Claude Opus 5.5 (high effort)

All Internet and Intranet chapter 4 questions →