How do cookies work?

Cookies are small pieces of data that a website sends to a user's browser to store on their computer. They are used to track information about the user's visit, such as preferences or activity history.

Example of cookie operation

The process of how cookies work is as follows:

Server sends a cookie: When a user makes the first request to a website, the server can create a cookie and send it along with the HTTP response. The response header will include a Set-Cookie field.
```
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: user_id=abc123; Expires=Wed, 21 Oct 2023 07:28:00 GMT; Path=/
```
Browser stores the cookie: The user's browser accepts the cookie and saves it locally. The cookie contains the following information:
- Name: The name of the cookie (e.g., user_id).
- Value: The value of the cookie (e.g., abc123).
- Domain: The domain for which the cookie is valid.
- Path: The path on the domain for which the cookie is valid.
- Expires or Max-Age: The date and time or lifetime of the cookie in seconds. If absent, the cookie is session-based (deleted when the browser closes).
- Secure: Indicates that the cookie should only be sent over HTTPS.
- HttpOnly: Indicates that the cookie is inaccessible via JavaScript API (to protect against XSS).
- SameSite: Controls sending cookies with cross-site requests (to protect against CSRF).
Browser sends the cookie back: On subsequent requests to the same domain and path (specified in the cookie), the browser automatically includes the stored cookie in the Cookie header of the HTTP request.
```
GET /some/page HTTP/1.1
Host: example.com
Cookie: user_id=abc123
```
Server processes the cookie: The server receives the cookie from the request and can use the information contained within it to identify the user, personalize content, maintain session state, etc.

There are two main types of cookies:

Session cookies: Have no expiration date and are deleted when the browser closes. Used to store information for a single session.
Persistent cookies: Have an expiration date (Expires or Max-Age) and are stored on the user's disk. Used to remember information between sessions.

Cookies are widely used for functions such as:

Session management: Maintaining state between sequential user requests.
Personalization: Customizing the appearance or content of a website according to user preferences.
Tracking: Analyzing user behavior on the site.

It is important to note that cookies have size limitations (usually around 4 KB) and quantity limits per domain. There are also privacy mechanisms, such as third-party cookies and browser user settings, which can affect their operation.