← Back to glossary

HTTP state mechanism storing name/value pairs with scope and expiry attributes.

Definition

Cookies are client-side state sent in HTTP headers and scoped by domain/path with expiry and security flags (Secure, HttpOnly, SameSite). They support sessions and preferences but also enable cross-site tracking when shared.

In plain English HTTP state mechanism storing name/value pairs with scope and expiry attributes.

Why this matters

Why it matters: Cookie controls affect authentication security and tracking prevention.

Example

Example: Session cookie with HttpOnly and SameSite set to reduce theft and CSRF risk.