Cookies: state on top of HTTP

Several sites, some of which use cookies, visited several times. For each request, the browser looks in its cookie store: if it has a live cookie for that site it sends Cookie; if not, the server may answer with Set-Cookie. Follow the decision, the messages and the store.

Sites

Each site has a page (index.html) with objects, which may be hosted by another site (third party). A site that uses cookies assigns the indicated cookie to a browser that arrives without it. Max-Age in seconds; empty: session cookie, deleted when the browser closes.

Cookies already in the store

Rows of other sites in the cookie store before the first visit. They do not expire in this scenario.

Visits

Each visit loads the page of a site t seconds after the previous visit. Tick whether the browser was closed in between: session cookies are then deleted; the rest survive until their Max-Age.

Examples

Practice

Generates random sites and visits and hides the headers: for each request of the chosen visit, say whether it carries Cookie and whether the response carries Set-Cookie.

View

Export

Decision for each request

Messages of this visit

Cookie store before and after the visit

What each server knows so far

Two headers with two roles: the cookie tells the server that it is the same browser (it joins the visits); Referer tells it which page each request came from (it names them). Without the cookie, two anonymous requests; without Referer, the same browser but unknown pages.

Model assumptions
  • HTTP is stateless: each request arrives without memory of the previous ones. Cookies add that state on top: Set-Cookie in responses, Cookie in requests, and a cookie store managed by the browser with one row (site, name=value, expiry) per cookie.
  • A site that uses cookies answers a request that arrives without its cookie with Set-Cookie: a new identifier, only in that response. The browser stores the row and from then on sends Cookie in every request to that site: the embedded objects, later visits, and also requests made from a page of another site (third-party cookie).
  • The store is per site: a cookie is never sent to another site. One cookie per site in this model.
  • With Max-Age=N the cookie lives N seconds from when it was received; when it expires, the browser deletes it and the next request arrives without it, so the server assigns a new identifier. Without Max-Age (or Expires) it is a session cookie: it is deleted when the browser closes.
  • Within a visit the page is requested first and then its objects in order. Every response is 200 OK; the cache, authorization (401) and the other cookie attributes (Domain, Path, Secure, HttpOnly) are out of the model. Visits are instantaneous.
  • The cookie value is only a key: the real state (session, cart, what pages a browser has visited) is in the server's database. A cookie identifies a browser on a computer, not a person.