Cookies in HTTP

Introduction

HTTP is a stateless protocol, meaning that each request and response are treated as independent transactions. After responding to a client's request, the server does not remember any information about that client.

However, many modern web applications require remembering user information across multiple requests. To achieve this, HTTP uses cookies.

---

Definition

A cookie is a small piece of information created by a web server, stored by the client's browser, and sent back to the server in future requests to identify the client or maintain session information.

Cookies allow websites to remember users and maintain state between different HTTP requests.

---

Why are Cookies Needed?

Cookies are used because many web applications need to remember user information, such as:

• E-commerce websites to maintain shopping carts.
• Registered user websites to recognize logged-in users.
• Web portals to remember user preferences.
• Advertising websites to track user browsing behavior.

---

Creation and Storage of Cookies

The creation and storage of cookies involve the following steps:

1. Client sends a request to the web server.
2. Server creates a cookie, containing information about the client (such as user ID, session ID, or preferences).
3. The server stores this information on its side and includes the cookie in the HTTP response using the Set-Cookie header.
4. Browser stores the cookie in its cookie directory, organized by the server's domain name.

---

Using Cookies

When the client visits the same website again:

1. The browser checks its cookie storage.
2. If a cookie for that website exists, it is included in the request using the Cookie header.
3. The server reads the cookie and recognizes the client as a returning user.
4. The server retrieves the associated user information and continues the session.

Important: The browser stores the cookie but does not interpret or modify its contents. The cookie is created by the server and intended to be read only by the server.

---

Working of Cookies

Client (Browser)                Web Server
      |                              |
1. Request ------------------------> |
      |                              |
2. Create Cookie                     |
      |                              |
3. Response + Set-Cookie ----------> |
      |                              |
4. Browser stores Cookie             |
      |                              |
5. Future Request + Cookie --------> |
      |                              |
6. Server identifies client          |

---

Applications of Cookies

1. Electronic Shopping (E-commerce)

Cookies help maintain a user's shopping cart.

• When a customer selects an item, the server stores the item information.
• The cookie contains the customer's session or cart ID.
• Every new request carries the cookie.
• At checkout, the server retrieves the shopping cart and calculates the total bill.

---

2. User Authentication

Websites that allow access only to registered users use cookies to remember authenticated users.

• After successful login, the server creates a cookie.
• During future visits, the browser sends the cookie.
• The server verifies the cookie and grants access without requiring repeated login.

---

3. Personalized Web Portals

Cookies store user preferences.

Examples include:

• Preferred language
• Favorite news categories
• Customized homepage settings

When the user revisits the website, these preferences are automatically restored.

---

4. Online Advertising

Advertising agencies use cookies to monitor user interests.

• A user clicks an advertisement.
• The advertising server stores a cookie containing a unique user ID.
• Future browsing behavior is associated with that ID.
• User preferences can then be analyzed for targeted advertising.

This use of cookies has raised concerns about user privacy.

---

Example: Cookie in an Online Shopping Website

Consider an online toy store named BestToys.

1. A customer visits the website.
2. The server creates a shopping cart with an ID (e.g., 12343).
3. The server sends the web page along with a Set-Cookie: 12343 header.
4. The browser stores the cookie.
5. When the customer selects a toy, the browser sends Cookie: 12343 with the request.
6. The server identifies the customer's shopping cart and updates it.
7. During checkout, the browser again sends the same cookie.
8. The server retrieves the shopping cart, processes payment, and sends an order confirmation.

Thus, the cookie enables the server to recognize the customer throughout the shopping session.

---

Advantages of Cookies

• Maintains user sessions.
• Supports shopping carts in e-commerce.
• Remembers login information.
• Stores user preferences.
• Enables personalized web services.
• Improves user experience.

---

Disadvantages of Cookies

• Can be used to track users' browsing activities.
• May compromise user privacy if misused.
• Can be exploited if not properly secured.

---

Summary

Cookies are small pieces of information created by a web server and stored in the client's browser to maintain state in the otherwise stateless HTTP protocol. They are widely used for session management, user authentication, shopping carts, personalization, and targeted advertising. When a client revisits a website, the browser automatically sends the stored cookie, allowing the server to recognize the user and continue previous interactions.