Cookies, sessions and state

Set-Cookie attributes, Domain, Path, Secure, HttpOnly and SameSite, session identifiers, third-party cookie restrictions, and storage alternatives.

Set-Cookie and its attributes

HTTP is stateless: each request stands alone. Cookies are the mechanism that lets a server recognise the same client across requests, and every protection you get comes from the attributes you attach when you set them.

HTTP/1.1 200 OK
Set-Cookie: sid=8f3c1a...; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=604800
Set-Cookie: theme=dark; Path=/; Max-Age=31536000; SameSite=Lax

• A cookie is scoped by host and path, never by port. Two apps on ports 8080 and 8081 of one host share cookies.
• Cookies are not secret storage: they sit in the browser profile and are attached automatically to matching requests.
• Deleting a cookie means sending Set-Cookie with the same name, path and domain plus Max-Age=0.

Session identifiers

GET /dashboard HTTP/1.1
Host: app.example.com
Cookie: sid=8f3c1a...; theme=dark
If-None-Match: "v7"

// Node/Express sketch: server-side session in Redis
app.use(session({
  name: 'sid',
  secret: process.env.SESSION_SECRET,
  store: new RedisStore({ client: redis }),
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 1000 * 60 * 60 * 8
  }
}));

• The cookie carries only an opaque identifier; the data lives server-side, so you can revoke a session by deleting the record.
• Rotate the identifier on login and on privilege change to prevent session fixation, where an attacker plants a known id beforehand.
• Enforce both an idle timeout and an absolute one: eight hours of inactivity, or seven days regardless of activity.
• Logging out must invalidate the server-side record, not merely clear the cookie — a copied cookie would otherwise still work.

Third-party restrictions and alternatives

// an in-memory access token avoids XSS readability but dies on reload
let accessToken = null;

export function setToken(t) { accessToken = t; }
export function authHeader() {
  return accessToken ? { Authorization: 'Bearer ' + accessToken } : {};
}

// and refresh through an HttpOnly cookie the JS never sees
async function refresh() {
  const r = await fetch('/auth/refresh', { method: 'POST', credentials: 'include' });
  if (!r.ok) throw new Error('session expired');
  setToken((await r.json()).access_token);
}

• Third-party cookie blocking breaks embedded widgets that relied on them; same-origin iframes and Partitioned cookies are the replacement patterns.
• Storing credentials in localStorage turns any XSS into a lasting account takeover — an HttpOnly cookie is strictly better for sessions.
• A token in memory plus an HttpOnly refresh cookie is the common compromise for single-page apps.

FAQ

Related

Authentication on the wire HTTP API design in practice

Last refreshed 2026-09-18.