Website Cookies

Technical explanation

Servers set cookies through Set-Cookie; browsers return matching values in Cookie according to domain, path, expiry, Secure, HttpOnly, SameSite, and other rules. Cookies may support sessions, preferences, security, analytics, or advertising and may be first-party or third-party by context.

Business relevance

Cookies enable essential session and personalisation functions and can support measurement, but their use affects privacy, consent, security, vendor governance, and analytics reliability.

Implementation example

An application stores a random session identifier in a Secure, HttpOnly, SameSite cookie, keeps sensitive account data server-side, rotates the identifier after login, and applies consent controls to non-essential analytics cookies.

Limitations and common misconceptions

Cookies can be stolen, leaked, blocked, deleted, or used for intrusive tracking. They have size and scope limits, cross-site availability is declining, and consent does not replace data minimisation or secure design.

Topics

Sources