Contents
Here’s how it works:
- Server opens a session (sets a cookie via HTTP header)
- Server sets a session variable.
- Client changes page.
- Client sends all cookies, along with the session ID from step 1.
- Server reads session ID from cookie.
- Server matches session ID from a list in a database (or memory etc).
Creating cookies. After receiving an HTTP request, a server can send one or more Set-Cookie headers with the response. The cookie is usually stored by the browser, and then the cookie is sent with requests made to the same server inside a Cookie HTTP header.
How cookies can be used for session management?
Browsers and e-commerce sites use HTTP to communicate. This cookie is sent back to the server when the user tries to access certain pages. The cookie allows the server to identify the user and retrieve the user session from the session database, so that the user session is maintained.
Cookies allow you to proceed through many pages of a site quickly and easily without having to authenticate or reprocess each new area you visit. Session cookies allow users to be recognized within a website so any page changes or item or data selection you do is remembered from page to page.
4096 bytes
The max size of a cookie is 4096 bytes.
How are cookies used in a web application?
Most Web Applications use cookies to manage the session for a user and allow you to stay logged in even if the browser was closed. Let’s assume we did everything by the book to make sure the cookie itself is safe.
This risk is inherent in using cookies to authenticate sessions: the cookie is a bearer token, anyone who can present the cookie is authenticated. requiring re-authentication for critical actions (e.g. making a bank transfer or changing your password). It doesn’t make sense to “protect” against this.
Is it possible to prevent someone with physical access to the machine to copy the cookie and reuse it on another machine and thus stealing the session? This risk is inherent in using cookies to authenticate sessions: the cookie is a bearer token, anyone who can present the cookie is authenticated.
Why are cookies deleted only on client side?
No change that you make (expiring the cookie, setting additional expiration information in a new ticket and replacing the cookie, adding additional “logged out” cookies” can prevent the original cookie from being used as long as it is valid. Is this a problem? In practice, not usually.