How Cookies Work

Cookies are a technique developed to personalize content (for instance, by storing information about a user, that can be incorporated into pages from that site in the future) and to make up for a limitation of the web. As originally designed, a web server sat around and handled requests for web pages, without trying to remember who asked for what page last, what data they submitted in that web form asking for their address, etc. Each page request was treated as a separate task, completely unrelated to any tasks (other page requests or web page form data submissions) that came before it. This type of behavior is referred to as “stateless” because the server does not keep track of the “state” of any of the clients who might have requested web pages from it.

Because many web applications need to keep track of where a user has been (and who the user is), the idea of a “magic cookie” was born. The way it works is that the web server passes the browser a “cookie” which may contain data gathered by the web server (such as the user’s email address) or maybe simply a “magic number” understood internally by the web server that identifies which connection (series of transaction) this page request is associated with, and, whenever the browser contacts the web server, it sends back the cookie, thus, identifying itself to the web server. The cookie is often (but not always) stored as a text file on disk.

Cookies

A cookie is a piece of information sent from a web server to a web browser, which is usually stored on the user’s PC for future use.

Depending on what information a user has provided to a web server, sensitive data may be in any cookie the web server asks to be stored on that user’s PC. Cookies can only contain information that was provided by the user to the web server.