an HTTP cookie

HTTP is forgetful: by design the server treats each request as if it had never met you before. But websites need to remember things — that you are logged in, what is in your shopping cart, your language preference. A cookie is the simple trick that gives a stateless protocol a memory. It is a small piece of text the server asks your browser to store and then hand back on every later request to that site, like a coat-check ticket: the cloakroom does not remember your face, but your ticket number lets them find your coat again.

The mechanism is two headers. On a response, the server sends "Set-Cookie: sessionId=abc123". Your browser saves that string, tagged with the site it came from. On every subsequent request to that same site, the browser automatically attaches "Cookie: sessionId=abc123". The server reads it and now recognises the request as part of an ongoing relationship. Usually the cookie does not hold your real data; it holds a random session ID, and the server keeps the actual data (your cart, your login) in its own database, keyed by that ID. That way the secret on your machine is just a meaningless token, and the real state stays server-side.

Cookies are what turn the stateless web into stateful applications, but they come with baggage. Because the browser sends them automatically, a cookie set on one site is silently attached to every request to that site — which third-party advertisers exploited to track people across the web, and which attackers exploit in cross-site request forgery. That history is why modern cookies carry attributes like Secure (only over HTTPS), HttpOnly (hidden from page scripts), and SameSite (do not send on cross-site requests), and why "do you accept cookies?" banners exist. A cookie is just stored text; whether it is benign or invasive depends on what is in it and who can read it.