Cookie

lastmod 2024-01-07created 2015-03-137 edits

A cookie is a kind of hypertext record (HTTP) and refers to a small file of record information that, when an internet user visits a website, the server used by that site installs on the user's computer. It is also called an HTTP cookie, web cookie, or browser cookie. The information in this record file is read every time the user visits the same website and is frequently updated with new information. Since this mechanism was devised by Lou Montulli, then a programmer at Netscape, many servers and websites today have used it widely for browser responsiveness.

Libraries

• js-cookie
• next-client-cookies (Nextjs)
• react-cookie (React)
• universal-cookie - Universal cookies for JavaScript
• universal-cookie-express - Hook cookies get/set on Express for server-rendering

SameSite

• Browser cookies and the SameSite attribute / seob.dev

SameSite cookies are a technology created to solve the security problems of the third-party cookies mentioned earlier. They restrict the sending of cookies for cross-site requests.

Three SameSite cookie policies can be chosen, None, Lax, and Strict, and each behaves differently.

None

Behaves the same as cookies did before SameSite existed. Cookies set to None are always sent, even for cross-site requests. In other words, third-party cookies are sent too. Therefore, in terms of security, it has the same problems as cookies without SameSite applied.

Strict

The most conservative policy. Cookies set to Strict are never sent for cross-site requests. In other words, third-party cookies are not sent, and only first-party cookies are sent.

Lax

A relatively looser policy than Strict. When set to Lax, third-party cookies are generally not sent, but they are sent for a few exceptional requests.

See also

• Web
• Federated Learning of Cohorts (FLoC) - FLoC, an alternative to third-party cookies for interest-based advertising

Favorite site

• Wikipedia (en) Description of cookies
• Cookie (Cookie) Persistent Cookie & Session Cookie
• SecureFlag
• Samsung Software Membership: Cookie in HTTP
• Cookie attributes
• Cookie (HTTP Session) security ¹
• Joinc: HTTP cookie

Cookie & Session

• In practice! Security checkpoints for developers ② Web server security basics - HTTP, Cookie, Session
• HTTP Protocol / Cookie summary
• What is an HTTP Session?
• ASP.NET Web API and HTTP cookies

Documentation

• [https://msdn.microsoft.com/en-us/library/windows/desktop/aa384321(v=vs.85.aspx MSDN: HTTP Cookies]

References