KIM COMPUTER

Comprehensive Guide to Cookies

A Cookie is a small piece of text data stored in the user's browser by a web server. It is primarily used to overcome the 'Stateless' nature of HTTP and to identify users.

1. Key Functions of Cookies

  1. Session Management: Maintaining login status, shopping carts, etc.
  2. Personalization: Remembering user preferences (language, dark mode, etc.).
  3. Tracking: Analyzing user behavior for targeted advertising.

2. Role of Cookies in the Login Process

  1. Authentication: The user submits credentials (ID/Password).
  2. Session Creation & Cookie Issuance: The server verifies the credentials, creates a session in memory, and sends a Session ID back to the browser inside a cookie.
    • Example: Set-Cookie: session_id=abc12345; HttpOnly; Secure
  3. Storage: The browser stores the cookie in its local storage.
  4. Automatic Submission: For every subsequent request to the same site, the browser automatically includes the cookie in the HTTP headers.
  5. Persistence: The server recognizes the Session ID and keeps the user logged in without requiring re-authentication for every page visit.

3. Security Attributes

Critical settings for protecting login cookies: * HttpOnly: Prevents access to the cookie via JavaScript, mitigating XSS attacks. * Secure: Ensures the cookie is only sent over encrypted HTTPS connections. * SameSite: Controls whether cookies are sent with cross-site requests to prevent CSRF attacks.

4. Cookie vs. Local Storage

Feature Cookie Local Storage
Capacity Small (~4KB) Large (~5MB+)
Auto-transfer Sent automatically with every request Not sent automatically (Manual handling)
Expiration Customizable (Expires at set time) Persistent (Until manually deleted)