Cookies: state on top of HTTP

Several sites, some of which use cookies, visited several times. For each request, the browser looks in its cookie store: if it has a live cookie for that site it sends Cookie; if not, the server may answer with Set-Cookie. Follow the decision, the messages and the store.

Sites

Each site has a page (index.html) with objects, which may be hosted by another site (third party). A site that uses cookies assigns the indicated cookie to a browser that arrives without it. Max-Age in seconds; empty: session cookie, deleted when the browser closes.

Cookies already in the store

Rows of other sites in the cookie store before the first visit. They do not expire in this scenario.

Visits

Each visit loads the page of a site t seconds after the previous visit. Tick whether the browser was closed in between: session cookies are then deleted; the rest survive until their Max-Age.

Examples

Practice

Generates random sites and visits and hides the headers: for each request of the chosen visit, say whether it carries Cookie and whether the response carries Set-Cookie.

View

Export

Decision for each request

Messages of this visit

Cookie store before and after the visit

What each server knows so far

Two headers with two roles: the cookie tells the server that it is the same browser (it joins the visits); Referer tells it which page each request came from (it names them). Without the cookie, two anonymous requests; without Referer, the same browser but unknown pages.

Model assumptions
  • HTTP is stateless: each request arrives without memory of the previous ones. Cookies add that state on top: Set-Cookie in responses, Cookie in requests, and a cookie store managed by the browser with one row (site, name=value, expiry) per cookie.
  • A site that uses cookies answers a request that arrives without its cookie with Set-Cookie: a new identifier, only in that response. The browser stores the row and from then on sends Cookie in every request to that site: the embedded objects, later visits, and also requests made from a page of another site (third-party cookie).
  • The store is per site: a cookie is never sent to another site. One cookie per site in this model.
  • With Max-Age=N the cookie lives N seconds from when it was received; when it expires, the browser deletes it and the next request arrives without it, so the server assigns a new identifier. Without Max-Age (or Expires) it is a session cookie: it is deleted when the browser closes.
  • Within a visit the page is requested first and then its objects in order. Every response is 200 OK; the cache, authorization (401) and the other cookie attributes (Domain, Path, Secure, HttpOnly) are out of the model. Visits are instantaneous.
  • The cookie value is only a key: the real state (session, cart, what pages a browser has visited) is in the server's database. A cookie identifies a browser on a computer, not a person.

About this visualization

An HTTP cookie simulator with several web sites, each with a page and embedded objects that may be hosted by another site (third-party cookies), visited several times. A site that uses cookies answers the first request that arrives without its cookie with Set-Cookie (name=value and, if given, Max-Age); the browser stores a row (site, name=value, expiry) in its cookie store and from then on sends Cookie in every request to that site: the objects, later visits and requests made from pages of other sites. A cookie is never sent to another site. When it expires (Max-Age) or, for a session cookie, when the browser closes, it is deleted and the server assigns a new identifier. The visualization shows the decision tree for each request, the browser–servers sequence diagram with the Cookie, Set-Cookie and Referer headers, the cookie store before and after each visit and what each server knows (third-party tracking). It includes the class example, figure 2.10 of Kurose and Ross, third-party tracking, the session cookie, random exercises and SVG/PNG export.

Concepts: HTTP cookies, Set-Cookie, Cookie, cookie store, Max-Age, session cookie, third-party cookies, tracking, Referer, state on top of HTTP.

Formulas:

Network Architecture I, Session 2.3 · Enrique de la Hoz, University of Alcalá · License CC BY-SA 4.0 · Source and catalogue on GitHub · DOI 10.5281/zenodo.23285664