Cookie

Cookies were introduced by Netscape in 1994 and are specified today by RFC 6265 (April 2011), which described actual browser behaviour after the earlier RFC 2109 and RFC 2965 failed in practice; the IETF revision known as RFC 6265bis codifies later additions such as SameSite and cookie prefixes. A server sends one Set-Cookie response header per cookie, and the browser returns matching cookies as name=value pairs in a single Cookie request header. Attributes control scope and lifetime: Expires or Max-Age (Max-Age wins if both are present; neither makes it a session cookie), Domain (omitted means host-only; set means the domain and all subdomains, and a public suffix is refused), Path (a convenience, not a security boundary), Secure, HttpOnly and SameSite with the values Strict, Lax or None, where None requires Secure. RFC 6265 §6.1 asks browsers to support at least 4096 bytes per cookie, 50 cookies per domain and 3000 in total; Chrome caps lifetimes at 400 days.

Cookie scoping predates and differs from the same-origin policy: cookies are keyed by host or domain and path, historically not by scheme or port, so http and https versions of a host and different ports have traditionally shared cookies. A compromised or attacker-controlled subdomain can therefore set cookies for its parent domain (cookie tossing) and fix a victim's session. The prefixes __Secure- (must carry Secure) and __Host- (Secure, Path=/ and no Domain, hence host-only) let a server detect such injection. SameSite works on the site (scheme plus registrable domain from the Public Suffix List), not the origin; Chrome made Lax the default for cookies without the attribute in 2020.

A session cookie is a bearer token, so every theft path matters: script access through XSS (blocked by HttpOnly), network interception (blocked by Secure together with HSTS), and increasingly infostealer malware that copies the browser's cookie store and replays the session elsewhere, bypassing MFA entirely. Browser vendors respond with measures such as Chrome's app-bound encryption of the cookie store and device-bound session credentials. Because cookies are attached automatically, they also enable CSRF, which SameSite reduces but does not fully remove; the session identifier must also be regenerated at login to prevent session fixation.

Legally, ePrivacy Directive 2002/58/EC Art. 5(3), as amended in 2009, requires consent before storing or reading information on a user's device unless strictly necessary for a service the user requested; in Denmark this is implemented by the cookiebekendtgørelse. Consent must meet the GDPR standard, and the CJEU held in Planet49 (C-673/17, 2019) that pre-ticked boxes are not valid consent. Safari and Firefox block or partition third-party cookies by default, the Partitioned attribute (CHIPS) gives embedded services per-site cookie jars, and Google has abandoned its plan to phase out third-party cookies in Chrome.