---
title: "Cookies and their types"
subject: "Internet and Intranet"
chapter: 4
key: "semester_8/internet_and_intranet:cookies-types"
source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/cookies-types
site: BCT Engineering
---

# Cookies and their types

Internet and Intranet · Chapter 4: HTTP and the Web Services

- Asked in: 2074 Bhadra, 5 marks; 2073 Bhadra, 4 marks; 2070 Bhadra, 4 marks (asked 3 times)
- Video: [Every Type of Internet Cookies Explained in 9 Min](https://www.youtube.com/watch?v=7pdEVssuSEo) — Explanitron
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/cookies-types
- Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-4

## Question

What is cookie? What are the types of cookie? Explain.

## Short answer

A cookie is a small text piece the server sets via Set-Cookie to maintain state across stateless HTTP requests. Types include session (browser-close deletion), persistent (expiry date), first-party vs third-party (tracking), and security-oriented Secure/HttpOnly cookies.

## Answer

#### What is a cookie?

A **cookie** is a small piece of text data (name=value, up to about 4 KB) that a web server sends to the browser, which stores it and returns it with later requests to the same site. HTTP is stateless, so cookies let a site remember users: login sessions, shopping carts, preferences and tracking.

**Four components**
1. `Set-Cookie:` header in the HTTP response.
2. `Cookie:` header in later HTTP requests.
3. Cookie file kept by the user's browser.
4. A back-end database at the web site that links the cookie ID to user data.

```text
 Browser                         Server
   |-- GET /home ---------------->|
   |<- 200 OK, Set-Cookie: id=1678|  (server creates DB entry 1678)
   |-- GET /cart, Cookie: id=1678>|  (server recognises user)
```

Attributes: `Expires/Max-Age`, `Domain`, `Path`, `Secure`, `HttpOnly`, `SameSite`.

#### Types of cookies

By lifetime
- **Session (transient) cookies:** no expiry date; kept in memory and deleted when the browser closes. Used for login sessions and carts.
- **Persistent cookies:** have an expiry date; saved on disk and survive restarts. Used for "remember me" and preferences.

By origin
- **First-party cookies:** set by the site the user is visiting.
- **Third-party cookies:** set by another domain (advertisers, analytics, embedded content), used to track users across sites. Many browsers now block them.

By purpose or security
- **Secure cookies:** sent only over HTTPS.
- **HttpOnly cookies:** not readable by JavaScript, reducing XSS theft.
- **Tracking / advertising cookies**, **authentication cookies**, and **supercookies / zombie cookies** (hard to delete) are further categories.

Privacy concern: cookies can build profiles of users, so users can control or delete them in browser settings.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Why are cookies needed?
   A. HTTP is stateless, so cookies let a site remember users
   B. HTTP is encrypted
   C. They speed up TCP
   D. They replace DNS
   Answer: A. Cookies add state to stateless HTTP for logins, carts, preferences and tracking. (Key point: Why cookies)

2. Which is NOT one of the four components of cookie technology?
   A. Set-Cookie header in the response
   B. Cookie header in later requests
   C. Cookie file in the browser
   D. Server-side DNS zone file
   Answer: D. The four components are the Set-Cookie header, Cookie header, browser cookie file, and a back-end database at the site. (Key point: Cookie components)

3. What distinguishes session from persistent cookies?
   A. Session cookies have no expiry and are deleted when the browser closes; persistent cookies have an expiry date and are saved on disk
   B. Session cookies are saved on disk; persistent are in memory
   C. Persistent cookies have no expiry
   D. Session cookies are third-party only
   Answer: A. Session cookies live in memory until the browser closes; persistent cookies survive restarts (remember me). (Key point: Session vs persistent)