Learn IT Fundamentals with Teacher Pochi

Cookie

Key points

  • A cookie is a small piece of data that a server has the browser hold onto, automatically sent back on later requests.
  • There are "first-party cookies" issued by the site itself and "third-party cookies" issued by other sites — the latter face tightening restrictions for privacy reasons.
  • As restrictions tighten, alternatives like Web Storage and token-based authentication are seeing wider adoption.

Cookie overview

A cookie is a small piece of text-format data that the browser stores at the server's instruction. Once stored, the browser automatically sends it back to the server on subsequent requests to the same site.

Server
Issues it
Browser
stores it
Sent automatically
from then on
Server receives
and checks it

This "issue → store → auto-send" round trip is the foundation for a wide range of uses, from staying logged in to remembering what's in a shopping cart.

Teacher Pochi's hintThis is a lot like a shop's stamp card. At checkout, you get a stamp added (issued), and you take it home in your wallet (stored). The next time you visit and show the card (sent), the shop instantly knows "this is a regular customer."

First-party cookies vs. third-party cookies

There are "first-party cookies," issued by the site you're currently viewing, and "third-party cookies," issued by a different domain embedded in that page — such as an ad or analytics tag.

🏠 First-party cookies Issued by the site you're viewing itself Mostly used within the site, e.g. to keep you logged in
📢 Third-party cookies Issued by a different domain embedded in the page, such as an ad or analytics tag Used to track behavior across multiple sites

Because third-party cookies can track which sites a user visits across the web, many browsers have been tightening restrictions on them in recent years for privacy reasons — we'll look at that in more detail shortly.

Teacher Pochi's hintA first-party cookie is like "that particular shop's own stamp card." A third-party cookie is more like "a shared points card accepted at many different shops" — with a shared card, the company running it can see every shop you've visited.

Cookie headers

Cookies are exchanged through two kinds of headers: the "Set-Cookie" header, attached to a server's response, and the "Cookie" header, attached to a browser's request.

Server
Set-Cookie:
session_id=abc123
Browser
stores it
Cookie:
session_id=abc123
Server receives
and checks it

A cookie stored in one browser is automatically attached, as this "Cookie" header, to every request that browser sends to the same site. This is what makes the "staying logged in while moving between pages" experience possible.

Cookie attributes

The Set-Cookie header can carry additional "attributes" that control its expiration and safety. The most common ones are:

Expires / Max-AgeAn expiration date. Without one, it's a "session cookie" that disappears when the browser closes.
SecureOnly sent over HTTPS. Makes interception harder.
HttpOnlyCan't be read from JavaScript. Prevents theft via malicious scripts.
SameSiteControls whether it's sent on requests that cross site boundaries.

A "keep me logged in" checkbox is often implemented through this expiration difference, and the "SameSite" attribute we'll cover next plays a big role in the tightening restrictions on third-party cookies.

Teacher Pochi's hintThink of Secure as "only transporting it in a locked car," and HttpOnly as "making sure only the driver, and no one else, can see what's inside the package." Both are safeguards against a valuable cookie being intercepted along the way.

Common uses for cookies

Cookies are used for a wide range of purposes, including:

🔑 Staying logged in Storing a session ID so you stay logged in as you move between pages
🛒 Remembering settings and state Keeping track of things like a language preference or a shopping cart's contents
📊 Analytics Recognizing repeat visits from the same user to analyze behavior
📢 Ad delivery Identifying users across sites to show ads matched to their interests

Cookie restrictions keep tightening

Third-party cookies in particular have drawn scrutiny for enabling cross-site behavioral tracking, and browsers and regulations alike have been tightening restrictions on them year after year.

🧭 Browser restrictions Safari and Firefox block third-party cookies by default Chrome is phasing them out gradually too
📜 Regulatory restrictions Laws like the EU's GDPR now require user consent for cookie use Consent banners ("cookie banners") have become a lot more common as a result

In response, websites have been shifting toward mechanisms that don't rely so heavily on cookies alone.

Teacher Pochi's hintIt's like flyers you used to be able to hand out freely, but now need permission for in advance. As privacy awareness has grown, the rules around this have gotten stricter and stricter.

Alternatives to cookies

Mechanisms that either replace or complement cookies have started to see use, including:

💾 Web Storage localStorage and sessionStorage stay in the browser only, and aren't automatically sent to the server
🎫 Token-based authentication The app manages a token, such as a JWT, and sends it only when needed
🕶️ Privacy-conscious ad technology New mechanisms that work with interest trends instead of tracking individual users (e.g. Privacy Sandbox)

That said, each of these alternatives comes with its own constraints, so cookies aren't going away entirely — the right choice depends on the use case.

Summary

A cookie is issued, stored, and sent via the Set-Cookie/Cookie headers — a basic mechanism websites use to identify users. The first-party/third-party distinction, along with attributes like expiration, Secure, HttpOnly, and SameSite, let you control how it's used and how safe it is. At the same time, restrictions on third-party cookies keep tightening, and adoption of alternatives like Web Storage and token-based authentication is growing.

Related topics:

🏠 Back to top