Cookie is important for Web Application.
HTTP is stateless, so to keep user info (login, access etc…) client side data is key to check status.
But, we sometime use cookie without understanding. Also, these days, cookie is strict to use for tracking purpose.
Server Response : Set-Cookie Header
Multiple Cookies HTTP/2.0 200 OK Content-Type: text/html Set-Cookie: key1=value1 Set-Cookie: key2=value2
Server Request : Cookie Header
Cookie and Session Cookie
Session Cookie : Save into browser memory. So, remove cookie when close a browser.
If Expires, Max-Age are not set, this is session cookie
Cookie : Save into file in browser. Now clear when the user close a browser.
The maximum lifetime of the cookies as an HTTP-date timestamp.
Host to which the cookie will be sent
If set subdomain, pararent domain is rejected
If set parent domain, subdomain is included
Leading dots in domain names are ignored
Set-Cookie: cookie-name=coookie-value; Domain=example.com
A path that must exist in the requested URL, or the browser won’t send the Cookie header
Set-Cookie: cookie-name=coookie-value; Path=/docs
Cookie is only sent to the server when a request is made with the https: scheme
Set-Cookie: cookie-name=coookie-value; Secure
Set-Cookie: cookie-name=coookie-value; HttpOnly
Controls whether a cookie is sent with cross-origin requests
Protect against cross-site request forgery attacks
|Strict||The browser sends the cookie only for same-site requests|
If the request originated from a different URL than the current one, no cookies with the SameSite=Strict attribute are sent
|Lax||The cookie is not sent on cross-site requests,|
such as calls to load images or frames,
but is sent when a user is navigating to the origin site from an external site
|None||The browser sends the cookie with both cross-site and same-site requests|
The Secure attribute must also be set
If you need to use cookie from other web site, need to use None
Set-Cookie: cookie-name=cookie-value; SameSite=None
Add using ; as seprator
Set-Cookie: cookie-name=cookie-value; Domain=domain-value; Secure; HttpOnly