What are Cookies?
Cookies are small pieces of data stored on the client's browser. They enable stateful interactions in the stateless HTTP protocol.
How Cookies Work
Server Response:
Set-Cookie: session=abc123; HttpOnly; Secure; Path=/; Max-Age=3600
Browser stores the cookie
Subsequent Request:
Cookie: session=abc123
Cookie Lifecycle
1. Server sends Set-Cookie header
2. Browser stores the cookie
3. Browser includes cookie in subsequent requests
4. Server reads Cookie header
5. Cookie expires or is deleted
Cookie Attributes
| Attribute | Purpose | Example |
|---|---|---|
| Name=Value | Cookie data | session=abc123 |
| Domain | Which domain can use it | .example.com |
| Path | Which URL paths use it | /api |
| Expires | Absolute expiration date | 2026-12-31T23:59:59Z |
| Max-Age | Relative expiration (seconds) | 3600 (1 hour) |
| Secure | Only send over HTTPS | Secure |
| HttpOnly | Not accessible via JavaScript | HttpOnly |
| SameSite | CSRF protection | Strict, Lax, None |
Cookie Security
# Secure cookie
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict
# Insecure cookie (avoid)
Set-Cookie: session=abc123
SameSite Attribute
SameSite=Strict → Never sent cross-site
SameSite=Lax → Sent on top-level navigation
SameSite=None → Always sent (requires Secure)
Cookies vs JWT Tokens
| Feature | Cookies | JWT Tokens |
|---|---|---|
| Storage | Browser (automatic) | Client (manual) |
| XSS Protection | HttpOnly flag | None by default |
| CSRF Protection | SameSite flag | Not vulnerable |
| Size Limit | 4KB | No limit |
| Server-side | Can be invalidated | Stateless |
Best Practices
Key Principles
- Follow SOLID principles
- Write clean, readable code
- Test thoroughly
- Document decisions
- Monitor in production
Implementation
- Start simple, refactor as needed
- Use established patterns
- Consider trade-offs
- Review with peers
Continuous Improvement
- Learn from incidents
- Update documentation
- Share knowledge
- Mentor others
Key Points
- Understanding Cookies is essential for production systems
- Always consider scalability and maintainability
- Test thoroughly before deploying to production
- Monitor performance and set up alerting
Common Patterns
- Validation: Always validate input at the boundary
- Error Handling: Use structured error responses
- Logging: Log key events for debugging
- Testing: Unit, integration, and load tests
- Documentation: Keep docs updated with code changes
Practice Problems
Design and implement a solution for Cookies in a backend system. Consider scalability, error handling, and production readiness.
Solution
// Cookies implementation
// Key aspects: validation, error handling, logging, testing
public class Cookies {
// Production-ready implementation
}Identify and handle edge cases for Cookies. What happens under high load, with invalid input, or during failures?
Solution
// Edge case handling:
// 1. Null/empty input -> validation
// 2. High load -> rate limiting, queuing
// 3. Failures -> retries, circuit breaker
// 4. Concurrent access -> locks, idempotencyWrite a testing strategy for Cookies. Include unit tests, integration tests, and performance tests.
Solution
// Test plan:
// - Unit: 80% coverage target
// - Integration: API contracts
// - Performance: latency, throughput
// - Chaos: failure injectionQuiz
1. What does the HttpOnly cookie attribute do?
2. What is the main security risk with cookies that don't use SameSite?
3. What is the primary purpose of Cookies?
4. What is a common mistake when implementing Cookies?
Flashcards
Question
What are cookies used for?
Click to reveal answer
Answer
Storing small pieces of data on the client for state management
Question
What does HttpOnly do?
Click to reveal answer
Answer
Prevents JavaScript access — protects against XSS attacks
Question
What is Cookies?
Click to reveal answer
Answer
Cookies is a key concept in backend development.
Question
When to use Cookies?
Click to reveal answer
Answer
Use Cookies when building production systems that require reliability, scalability, and maintainability.
Question
Cookies best practices
Click to reveal answer
Answer
Follow SOLID principles, write clean code, test thoroughly, document decisions, and monitor in production.
Revision Notes
Key Takeaways
- 1.Cookies enable stateful interactions in stateless HTTP
- 2.Key attributes: Secure, HttpOnly, SameSite
- 3.HttpOnly prevents XSS cookie theft
- 4.SameSite prevents CSRF attacks
- 5.Cookies are limited to 4KB
Interview Tips
- •Know the difference between cookies and JWT tokens
- •Understand SameSite attribute values
Cheat Sheet
Cookies
- Purpose: Client-side state storage
- Security: HttpOnly (no JS access), Secure (HTTPS only), SameSite (CSRF)
- SameSite: Strict, Lax, None
- vs JWT: Cookies=automatic, HttpOnly; JWT=manual, stateless