How do cookies and sessions work?

Definition:

A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.

Key points:

• A cookie is data the browser stores and sends with matching requests.

• A server-side session commonly stores login state behind a random cookie ID.

• Use HttpOnly, Secure and suitable SameSite settings for session cookies.

• Regenerate session IDs at authentication boundaries, expire inactive sessions and use a shared session store when instances must share logins.

Interview point:

• HttpOnly stops JavaScript from reading the cookie, but does not by itself stop CSRF or malicious scripts from making authenticated requests.