Web fundamentals
Cookies: how a website remembers a session
Authentication can depend on a small browser-held identifier rather than a repeated password entry.
Research articles and reference entries are published in English. Navigation is available in seven languages.
What travels with a request
A server can set a cookie that the browser stores and sends with matching later requests. Cookies can support sessions, preferences and other application state. A session cookie often identifies server-held account state rather than containing the password itself.
Cookie attributes affect handling. Secure restricts transmission to secure connections; HttpOnly blocks ordinary script access to the cookie; SameSite influences when it accompanies cross-site requests. These controls address different paths and are not interchangeable.
The application still decides
An application must associate the identifier with the correct account, expire it and invalidate it when appropriate. Protecting the password is insufficient if a stolen valid session can continue making authorised requests.
For users, a password change and an option to revoke other sessions can have different effects. Consult the service's account controls after a suspected compromise. For reviewers, inspect session creation, renewal and termination, not just the login form. Follow session theft and browser origin boundaries for the surrounding controls.