HTTP Cookie

web security

Definition

HTTP Cookie

A cookie is a small piece of data that a server attaches to an HTTP response via the Set-Cookie header. Because HTTP itself is stateless — each request is processed independently — cookies let the application implement stateful behaviour, such as authentication, personalisation, and (cross-site) tracking, by being sent back on subsequent requests.

The browser stores cookies in a cookie jar, one per site, and attaches them to every request whose URL matches. Only the cookie name/value is attached to outgoing requests; attributes and flags are only specified when the cookie is set.

Attributes and Flags

Cookie attributes and flags

Attribute / flag	Meaning
Expires, Max-Age	when the cookie expires; Max-Age takes precedence; unset $\Rightarrow$ deleted when the browser closes; negative Max-Age or past Expires $\Rightarrow$ delete now
Domain	scope widening: if set, cookie is sent to the host and all its subdomains; the value can reach up to eTLD+1 of the setting domain. A same-site attacker can both read and set domain cookies — set it only when unavoidable
Path	the cookie is sent only if its path is a prefix of the request URL’s path
SameSite	whether the cookie is sent on cross-site requests — see SameSite Cookie
Secure	cookie is sent only over HTTPS, and cannot be set or overwritten via HTTP (protection against a network attacker)
HttpOnly	JavaScript cannot read the cookie via document.cookie; defence in depth against XSS stealing the session cookie

Leading dot makes no difference

Domain=.example.com and Domain=example.com are equivalent — the dot is cosmetic. Subdomain cookies reach the apex; never set Domain unless the application genuinely spans origins.

SameSite behaviour

Definition

SameSite Cookie

The SameSite attribute of an HTTP cookie determines whether the cookie is attached to cross-site requests — requests where the site that initiates the request differs from the site the cookie belongs to. It has four possible values:

Value	Behaviour
None	attach to cross-site requests; Secure must be enabled
Lax	attach only to top-level cross-site navigations using a safe method (GET)
Strict	never attach to cross-site requests
(unspecified)	usually defaults to Lax after 2 minutes

A request from example.com that embeds an image from pics.com crosses sites; whether the cookie on pics.com is sent to pics.com along with that image fetch is exactly what SameSite decides.

Link to original