State and browser security
Cookies add state
Follow a cookie from Set-Cookie to later Cookie request headers and see how state is layered on top of stateless HTTP exchanges.
HTTP does not automatically connect one request to the next. Cookies add a small piece of browser-managed state.
The server sets a cookie in a response:
Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=LaxThe browser stores it and sends it on matching later requests:
Cookie: session=abc123Path and Domain control where a cookie is sent. Max-Age or Expires can make it persistent; otherwise it is normally a session cookie.
HttpOnly prevents JavaScript from reading it. Secure limits it to HTTPS. SameSite restricts when it is sent with cross-site requests.
Cookies are attached automatically, so keep them small and scope them carefully.
Lesson completed