Glossary

Cookie

A cookie is a small piece of data the server sends to the browser in a Set-Cookie header, which the browser automatically returns on every subsequent request to the same domain. This lets stateless HTTP "remember" the user.

Cookie attributes

HttpOnly — JavaScript cannot read the cookie. Protects against XSS theft
Secure — transmitted over HTTPS only
SameSite=Lax/Strict — restricts cross-site sending. Protects against CSRF
Expires / Max-Age — time to live; without it the cookie is session-scoped (deleted when the browser closes)
Domain / Path — which URLs the cookie is sent to

Cookie vs localStorage

localStorage is larger (5–10 MB vs 4 KB) and accessible only from JavaScript. Cookies are sent to the server automatically and can be HttpOnly (inaccessible to JS). HttpOnly cookies are safer for sessions and tokens.