A cookie is a small text record that a website stores in the browser so the site can remember a later visit or an existing login.
The browser sends that record back on later requests, which lets a shop cart or a signed in session survive a new page.
How it works
A first party cookie is set by the site the person is visiting, while a third party cookie is set by another service embedded on the page.
Session cookies usually disappear when the browser closes, and persistent cookies remain until they expire or the person deletes them.
Cookies can keep a reader logged in to a bookstore account, and they can also let an advertising network recognize the same browser across many news sites.
If an attacker steals a session cookie, that attacker may enter the account without knowing the password.
Concrete examples
- A bookstore site stores a cookie so the shopping basket still holds a novel after the reader opens the shipping page.
- A news site loads an advertising frame that sets its own cookie and later recognizes the same browser on a different magazine.
- A webmail session cookie lets the mailbox stay open while the employee moves from the inbox to the settings page.
Protective measures
- Mark cookies that carry a login as inaccessible to page scripts whenever the application can do that safely.
- Set a short lifetime on session cookies for the bank site and require a fresh login after a period of quiet.
- Explain in plain language which cookies your shop uses for the cart and which ones exist only for advertising.
- Give people a working way to reject optional cookies without breaking the payment step they still want to finish.
Related articles
Readers who want more on a bookstore website should open What is API security? next.
For day to day work on a bookstore website, add What is application security? to the same reading list.
People who look after a bookstore website compare this explanation with What is a security patch?.