Cookie: what it is and how to manage it

What are cookies?

A cookie (HTTP cookie) is a small piece of data that a web server sends to a browser. The browser stores it and sends it back with later requests to the same server.

Cookies allow a server to “remember” information between requests, such as an authenticated session, user settings, or shopping cart data.

How cookies work

1. Пользователь авторизуется на сайте
2. Сервер отправляет:
   Set-Cookie: session_id=abc123; HttpOnly; Secure; SameSite=Strict

3. Браузер сохраняет cookie

4. При следующем запросе:
   Cookie: session_id=abc123

5. Сервер идентифицирует пользователя

Types of cookies

By purpose

By lifetime

• Session cookies — deleted when the browser is closed
• Persistent cookies — stored until Max-Age/Expires expires

Cookie security attributes

Set-Cookie: session=abc123;
  HttpOnly;            /* недоступен через JavaScript */
  Secure;              /* только через HTTPS */
  SameSite=Strict;     /* не отправляется с других сайтов */
  Max-Age=3600;        /* срок жизни 1 час */
  Path=/;              /* доступен для всех путей */
  Domain=example.com   /* доступен для домена и поддоменов */

SameSite attribute

GDPR and cookie law

Under the GDPR (Europe) and Federal Law No. 152 (Russia), explicit user consent is required for analytics and advertising cookies:

<!-- Consent Banner (упрощённый пример) -->
<div id="cookie-banner">
  Мы используем cookie для аналитики.
  <button onclick="acceptCookies()">Принять</button>
  <button onclick="rejectAnalytics()">Только необходимые</button>
</div>

function acceptCookies() {
  localStorage.setItem('cookie-consent', 'all');
  initGoogleAnalytics(); // загружаем аналитику только после согласия
  document.getElementById('cookie-banner').remove();
}

Cookies and security

Main threats:

• XSS (Cross-Site Scripting) — cookie theft through malicious JS → protection: HttpOnly
• CSRF (Cross-Site Request Forgery) — forged requests → protection: SameSite=Strict + CSRF tokens
• Traffic interception — cookie theft over HTTP → protection: Secure + HTTPS

Third-party cookies and their phaseout

Google Chrome is gradually phasing out third-party cookies (third-party trackers). Safari and Firefox already block them. This is changing approaches to:

• Analytics (switching to first-party data)
• Retargeting (new mechanisms)
• Authentication (OIDC, OAuth)

Check cookies with reChecker

Use the Cookie Analyzer to analyze your website's cookies. The tool will show:

• All cookies set
• Their attributes (HttpOnly, Secure, SameSite)
• The lifetime of each cookie
• Potential security issues

FAQ

Do cookies affect website performance? Not significantly. Cookies are added to every HTTP request to the domain. Storing analytics data in cookies increases header size. For large-scale analytics, localStorage or IndexedDB is preferable.

What's the difference between cookies and localStorage? Cookies are sent to the server with every request and are accessible to the server. localStorage is only in the browser and is not sent to the server. Use cookies for authentication (the server checks them) and localStorage for client-side settings.

Do I need a cookie banner if my site only uses Google Analytics? Yes, under GDPR. Google Analytics uses analytics cookies that require consent. An exception applies if Google Analytics 4 is used in privacy mode (without cookies) with consent mode.