HTTP Cookies: Understand How Sessions, Security and Tracking Really Work

HTTP cookies are small name–value pairs that allow Web applications to maintain state across separate HTTP requests. In this handout, we will examine cookie attributes such as Domain, Path, Secure, HttpOnly, Expires, Max-Age and SameSite, and understand how they determine when a cookie is stored and sent. We will also study session cookies, which are often used to maintain authenticated sessions, and SameSite cookies, which regulate whether cookies can accompany same-site or cross-site requests. Finally, we will analyse third-party cookies, their role in cross-site contexts and tracking, and the broader classification of cookies by lifetime, context of use and purpose.

Cookies

Fullscreen Download

Key points

HTTP cookie = small name–value pair stored by the browser and automatically returned to the server when specified conditions are satisfied.

Cookies → allow applications to associate successive HTTP requests with previously stored state; HTTP itself remains a stateless protocol.

Cookie exchange → server sends Set-Cookie in an HTTP response; browser stores the value and returns it through the Cookie request header.

Cookie ≠ session: a cookie may contain a session identifier, while the corresponding authentication state and user information remain on the server.

Cookie attributes → control storage, scope, lifetime, and security; the browser evaluates these rules before deciding whether to send a cookie.

Domain → defines eligible hosts; Path → restricts URL paths; omitting Domain normally limits the cookie to the host that created it.

Secure → restricts transmission to secure connections; HttpOnly → prevents ordinary JavaScript access without blocking transmission through HTTP requests.

Expires ≠ Max-Age: Expires specifies an expiration date, while Max-Age defines a lifetime in seconds and takes precedence when both exist.

SameSite → controls cookie transmission in same-site and cross-site contexts, distinguishing requests associated with different websites.

SameSite=Strict → allows only same-site requests; Lax → also permits certain top-level cross-site navigations; None → permits cross-site use and requires Secure.

Cross-site navigation ≠ cross-site resource request: navigation changes the main document, while resource requests retrieve external content without leaving the current page.

Session management → authentication → server creates session identifier → browser stores cookie → subsequent requests identify the session → server validates access.

Logout → requires invalidating the server-side session and requesting cookie deletion; removing the cookie alone does not necessarily invalidate the session.

Session cookies ≠ persistent cookies: session cookies lack an explicit expiration time, while persistent cookies use Expires or Max-Age.

First-party ≠ third-party cookies: the distinction concerns the context in which cookies are used, not their purpose or whether they enable tracking.

Third-party cookies → may enable cross-site tracking when an external service recognizes the same browser across multiple websites, subject to browser restrictions.

External script ≠ third-party cookie: JavaScript downloaded from another domain can execute within the visited page and use cookies associated with that site.

Cookie classification → lifetime, context of use, and purpose are independent dimensions; persistence and first-party status do not determine tracking behavior.

Cookie purposes → technical functionality, preferences, analytics, and profiling; classification depends on actual use rather than the cookie’s name.

Italian privacy rules → technical cookies generally serve necessary functions; qualifying analytics cookies may be treated similarly, while profiling cookies normally require prior consent.