The Complete Handbook of Cookies

Chapter 1: Understanding Cookies

Cookies are one of the oldest and most fundamental mechanisms in web technology. Nearly every web application uses them, yet most professionals understand them only partially—as small files that get stored in your browser, associated with expiration dates, and somehow related to privacy and tracking. This chapter explains what cookies actually are, how they work mechanically, and why understanding them matters for your work.

What a Cookie Is

A cookie is a small text file—typically between 1 and 4 kilobytes—that a web server sends to a browser and that the browser then stores locally and sends back to the server in subsequent requests. That is the whole mechanism. It is not a program, not executable code, and not a file on your hard drive in the traditional sense. It is a key-value pair, plus metadata, stored in the browser's memory or on disk in a location managed by the browser itself.

When a server wants to create a cookie, it sends an HTTP response header called Set-Cookie. The header looks like this:

Set-Cookie: sessionId=abc123; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Strict

The browser reads this header and, if it matches the browser's cookie policies, stores the key-value pair (sessionId=abc123) along with the metadata (Domain, Path, Secure, HttpOnly, SameSite). On the next request to example.com, the browser automatically includes that cookie in the HTTP request header like this:

Cookie: sessionId=abc123

The server reads this header, recognizes the session ID, and knows which user or session it is talking to.