Syllabus Lesson 9 of 156 · Cookies, properly explained
Cookies, properly explained

The attributes that matter

Why it matters A cookie's small print decides who can read it, when it is sent and how long it lives. If you ever build a website, getting these six words right protects your users' logins. As a user, they let you read a cookie and judge it.

If a cookie is a cloakroom ticket, its attributes are the rules printed on the back: "valid until Friday", "show only at the main door", "staff use only". The ticket is the same; the rules decide where it can be used.

Attribute: an extra rule added after the name and value in a Set-Cookie header, separated by semicolons. The browser stores the rules and follows them; it never sends them back.

Here is a well-made login cookie:

Set-Cookie: session=8f3k2q; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400

The six you need

  • Secure: send this cookie only over encrypted https connections. On public Wi-Fi this stops anyone on the network from reading it as it travels.
  • HttpOnly: page scripts cannot read this cookie; only the browser and server see it. If a bad script ever gets into a page, it cannot simply copy the login cookie.
  • SameSite: whether the cookie is sent when the request starts on another site. Strict means never; Lax means only when you click a normal link to the site; None means always (and requires Secure). The next lesson shows why this matters.
  • Max-Age (or the older Expires): how long to keep the cookie, in seconds. 86400 is one day. With neither, it is a session cookie.
  • Domain: which hosts receive it. Leave it out and only the exact host that set it gets it. Domain=shopa.example also shares it with help.shopa.example and every other subdomain, which is wider, not narrower.
  • Path: which part of the site receives it. Path=/ means everywhere on the site; Path=/account means only addresses that start with /account.

Reading a tracker cookie

Set-Cookie: uid=u-7731; Secure; SameSite=None; Domain=adco.example; Max-Age=34560000

Read it slowly. SameSite=None means it is sent even when adco.example is embedded on another site, which is exactly what a third-party tracker needs. Max-Age=34560000 is 400 days. Neither attribute is wrong by itself, but together they describe a long-lived ticket designed to be seen everywhere.

Chrome treats a cookie that sets no SameSite as Lax. Firefox and Safari do not apply that default in the same way (checked October 2026). So if you build a site, always write SameSite yourself instead of relying on the browser.

A common misconception

"Setting Domain makes a cookie more private." It is the opposite. Leaving Domain out keeps the cookie on the single host that set it. Setting it shares the cookie with every subdomain.

Recap

  • Secure: https only. HttpOnly: no script access. SameSite: controls sending from other sites.
  • Max-Age sets the lifetime in seconds; without it, the cookie is a session cookie.
  • Domain widens a cookie to subdomains; Path limits it to part of a site.
  • SameSite=None plus a long Max-Age is the typical shape of a cross-site tracking cookie.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back