The Cookie Solution: What They Are and How They Work
Learn what cookies actually are, their structure, and how they are exchanged between browser and server.
In this lesson, you will learn to:
- Define what a cookie is, identify its key-value structure, and describe how cookies are exchanged between browser and server.
The Cookie Solution: What They Are and How They Work
This lesson defines cookies in practical terms, explains their key-value structure, and walks through the lifecycle of a cookie from creation to expiration.
What Exactly Is a Cookie?
At its core, a cookie is simply a small text file. It contains a few pieces of information that a website stores on your computer or device. When you visit a website, the server can send a cookie to your browser, which saves it. On every subsequent request to that website, your browser sends the cookie back. This is how the server recognizes you across different pages and visits.
Cookie structure: Key-Value pairs
Cookies store data as name-value pairs. Think of it like a dictionary or a label on a box. The name tells you what the data is for, and the value is the actual information.
Example: session_id=abc123xyz
- The name is
session_id - The value is
abc123xyz
Other common examples include:
user_pref=dark_mode— remembers your theme preferencecart_items=3— tracks how many items are in your shopping cartlanguage=en— remembers your language preference
Cookies also contain metadata that controls their behavior. This includes an expiration date (when the cookie should be deleted), the domain it belongs to (which website can read it), and security flags that we will explore in Module 2.
The Cookie Lifecycle
Cookies follow a predictable lifecycle from creation to deletion. Understanding this flow is essential to understanding how they work and how they can be intercepted.
Step 1: Creation
The server generates a cookie and sends it to the browser using the Set-Cookie HTTP response header. This header contains the cookie’s name, value, and any additional attributes like expiration or security flags.
Step 2: Storage The browser receives the cookie and stores it locally in a dedicated cookie file or database. Each browser manages storage differently, but the principle is the same: the cookie is saved for future use.
Step 3: Transmission
On every subsequent request to the same domain, the browser automatically includes the cookie in the Cookie HTTP header. The server receives this header and uses the cookie’s value to reconstruct the user’s state.
Step 4: Expiration Cookies have a lifespan. Session cookies are deleted when the browser is closed. Persistent cookies have an expiration date, after which the browser automatically removes them. Websites can also delete cookies manually by setting a past expiration date.
This continuous cycle enables the seamless web experience we take for granted. But as we will see in later modules, every step of this lifecycle presents an opportunity for attackers to intercept or manipulate cookies.