Cookies & Sessions

A cookie is like the wristband a club gives you at check-in. It's small, it's yours, and the doorman glances at it each time you walk back in, instead of asking for your ID again. HTTP (HyperText Transfer Protocol) is the language browsers and servers use to talk, and it normally forgets you the instant a request finishes. A cookie is a small piece of data the server asks your browser to keep and resend on every future request, so the server can recognize you. A session is the club's actual guest-list entry. It's the real record of who you are, stored on the server and found using the code printed on your wristband.

1. 1On your first visit, you have no wristband yet. The server has no way to tell you apart from a stranger.
2. 2When you log in, the server creates a session record — who you are and what you're allowed to do — and stores it under a fresh session ID.
3. 3The server tells your browser to remember that session ID as a cookie, and to attach it to every future request to this site.
4. 4Your browser automatically resends the cookie on the next request, without you doing anything.
5. 5The server reads the cookie, looks up that session ID in its records, and instantly knows who is asking.

This applies to login systems, shopping carts, 'remember me' features, and anything else that needs to recall who you are across separate requests. Plain HTTP requests are otherwise independent, with no memory between them.

• ⚠Don't think the cookie IS the session. The cookie is just the ticket with an ID printed on it. The actual data — who you are, your permissions — lives in the server's session store, not in the cookie itself.
• ⚠Don't forget that if the cookie never comes back — a new browser, it expired, or it was cleared — the server has no memory of you. It treats you as a brand-new stranger.