Cookies over HTTP
Control cookie scope and lifetime
Use host-only defaults, narrow paths, Max-Age, and matching deletion attributes instead of creating accidental cookies.
8 minute lesson
A cookie is identified by more than its name. Scope decides which cookie you update or delete.
Omit Domain to create a host-only cookie. Add a narrow Path when only one part of the site needs it. Use Max-Age for a controlled lifetime. A cookie without Max-Age or Expires is a session cookie, but browser session restore can keep it across a restart.
Set-Cookie: editor=compact; Path=/notes; Max-Age=3600; Secure; SameSite=Lax
Set-Cookie: editor=; Path=/notes; Max-Age=0; Secure; SameSite=LaxTo delete the intended cookie, match the original name, domain, and path. A different path creates or removes a different cookie with the same visible name.
Path controls delivery. It is not a security boundary. Code from another path on the same origin may still affect JavaScript-readable cookies.
Create two cookies with the same name and different paths. Observe which requests receive each one, then delete both using their exact scopes.
Lesson completed