Web developmentLesson 3 of 3 in the course HTTP and web servers

HTTP Cookies: State, Attributes, Privacy, and Security

5 flashcards · 5 quiz questions · 5 match pairs · 4 fill-in sentences · English

Save course
Lesson progress
0 / 5

Your progress is kept in this browser only.Sign up to save it

Summary

This lesson introduces HTTP cookies: what they are, where they are stored, and how they help websites remember information across requests. It also traces the early history of cookies.

An HTTP cookie is a small block of data created by a web server and stored on a user's device by the web browser. A website may store more than one cookie on a device, including during a single browsing session. The terms web cookie, browser cookie, and Internet cookie refer to the same general technology.

All flashcards

What is an HTTP cookie?
A small piece of data stored by a browser and sent with relevant future HTTP requests.
Why is HTTP described as stateless?
HTTP does not automatically retain memory of earlier requests; cookies can help connect requests.
Where did the term “cookie” for web technology come from?
Lou Montulli adapted it from “magic cookie,” a computing term for data a program receives and returns unchanged.
Why can an authentication cookie be a security risk if stolen?
It can act as a bearer credential: someone who can use a valid session cookie may be treated as the logged-in user.
What is a zombie cookie?
Data stored in alternate locations that recreates a browser cookie after the original is deleted.

Quiz questions

  1. Which HTTP header does a browser use to send applicable cookie name-value pairs in a request?Answer: Cookie
  2. What does the HttpOnly attribute do for a cookie?Answer: It prevents access through client-side APIs such as JavaScript.
  3. What does SameSite=None allow a browser to do with a cookie?Answer: Send it with cross-site requests, commonly when the cookie is also Secure.
  4. How does a cross-site request forgery attack commonly exploit a browser?Answer: It induces the browser to send a request with credentials for a site where the user is authenticated.
  5. When is a cookie generally considered third-party?Answer: When it is associated with a domain different from the site the user is visiting.

Based on the Wikipedia article HTTP cookie, licensed CC BY-SA 4.0. Adapted into a summary, flashcards and quizzes.

More in Web development

All Web development lessons
Web developmentJavaScript Foundations: Language, Runtime, Asynchrony, and Security5 flashcards · 5 quiz questions · 4 gamesPlay free →Web developmentDOM Nodes, Standards History, and JavaScript Manipulation5 flashcards · 5 quiz questions · 4 gamesPlay free →Web developmentSingle-Page Applications: Architecture, Communication, and Trade-offs5 flashcards · 5 quiz questions · 4 gamesPlay free →Web developmentCSS Foundations: Selectors, Cascade, Layout, and Standards5 flashcards · 5 quiz questions · 4 gamesPlay free →Web developmentJSON: Data Model, Syntax, Standards, Interoperability, and Applications5 flashcards · 5 quiz questions · 4 gamesPlay free →Web developmentREST Foundations: Resources, Constraints, and the Uniform Interface5 flashcards · 5 quiz questions · 4 gamesPlay free →