How do cookies and sessions work?
Try code in the playgroundUnderstand the concept
A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.
Important ideas
-
A cookie is data the browser stores and sends with matching requests.
-
A server-side session commonly stores login state behind a random cookie ID.
-
Use
HttpOnly,Secureand suitableSameSitesettings for session cookies. -
Regenerate session IDs at authentication boundaries, expire inactive sessions and use a shared session store when instances must share logins.
Can you explain it without the notes?
How do cookies and sessions work?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.
Turn this concept into a clear answer.
- HttpOnly stops JavaScript from reading the cookie, but does not by itself stop CSRF or malicious scripts from making authenticated requests.
Keep connecting the ideas.
Next lesson: What is CORS? Does it protect an API from all clients?Adapted from 02_NODE_EXPRESS_HTTP.md · “How do cookies and sessions work?”. Examples are study fragments; framework behavior can depend on your version.