An HTTP cookie is a small piece of data that a website stores in the user’s browser and that the browser sends back with every request, used for logins, settings and tracking.
How cookies work
A web server sets a cookie with the Set-Cookie response header; the browser then attaches it to later requests to the same site. The mechanism is specified in RFC 6265. Cookies fall into several groups:
- Session cookies – keep a user logged in; they usually contain a random session identifier.
- Persistent cookies – store preferences or “remember me” logins until an expiry date.
- Third-party cookies – set by embedded advertisers and analytics services to track users across sites; most browsers now restrict them.
Security attributes control how cookies behave: Secure sends them only over HTTPS, HttpOnly hides them from JavaScript, and SameSite limits sending them with cross-site requests.
Why cookies matter for security
A valid session cookie is as good as a password plus the second factor, because the login has already happened. Attackers therefore steal cookies to bypass multi-factor authentication – a form of session hijacking described in MITRE ATT&CK as T1539 (Steal Web Session Cookie). Infostealers copy cookie databases from browsers en masse, and stolen sessions are sold on criminal markets. In 2023 the Linus Tech Tips YouTube channel was hijacked after an employee ran malware that stole session cookies. Missing HttpOnly allows theft through cross-site scripting, and missing SameSite protection enables CSRF.
How to protect cookies
- Developers should set Secure, HttpOnly and SameSite on session cookies and bind sessions to short lifetimes.
- Invalidate sessions on logout and password change.
- Users should log out of important services, avoid pirated software and keep browsers updated.
