Learn · Cookies
Cookies
What is a cookie?
A cookie is a small piece of text a website asks your browser to store and send back on the next request. HTTP itself has no memory — every request arrives as if it were the first. Cookies are how a site recognises that this request came from the same browser as the last one.
That mechanism is neutral. It is what keeps you signed in, and it is also what lets an advertising network recognise you on an unrelated site. The difference is not the technology; it is who set the cookie and what they do with it.
First-party vs third-party
A first-party cookie is set by the site in your address bar. A third-party cookie is set by some other domain whose code the page loaded — an ad network, an analytics provider, an embedded video.
Third-party cookies are the ones that historically enabled cross-site profiling, because the same third party appears on thousands of sites and sees the same identifier each time. Browsers have been restricting them for years; many now block or partition them by default.
Why deleting every cookie logs you out
Because your session is a cookie. "Clear all cookies" is a blunt instrument: it removes the advertising identifier and your bank login in the same stroke. That is precisely why Sessyn distinguishes categories rather than offering a single delete button.
The attributes that matter
| Attribute | What it does | Why you should care |
|---|---|---|
| HttpOnly | Hides the cookie from JavaScript | Stops a cross-site scripting bug from stealing your session |
| Secure | Only sent over HTTPS | Prevents interception on a hostile network |
| SameSite | Controls sending on cross-site requests | The main defence against cross-site request forgery |
| Domain | Which hosts receive it | A host-only cookie is narrower and safer than a whole-domain one |
| Max-Age / Expires | How long it survives | A session cookie dies when you close the browser; a persistent one may last years |
SameSite, specifically
SameSite=Strict means the cookie is never sent when you
arrive from another site — safe, but it can log you out when you follow a
link in. SameSite=Lax is the common middle ground and the
modern browser default. SameSite=None permits cross-site
sending and requires Secure; it is the setting that makes
third-party tracking cookies work.
Session vs persistent
A session cookie has no expiry and is discarded when the browser closes. A persistent cookie carries an expiry date and survives restarts — which is what "remember me" means, and also what lets an identifier follow you for two years.
Last reviewed: 2026-09-12