---
id: 6a3b86eac73558aaa2679c15
title: How Are Cookies Stored, and What Are the Security and Privacy Implications?
challengeType: 19
dashedName: how-are-cookies-stored-and-what-are-the-security-and-privacy-implications
---

# --description--

Cookies are small text files that websites save on your device to remember some information about you.

Here's the process of receiving and storing cookies:

- You visit a website
- The website server sends a `Set-Cookie` header in its response
- Your browser receives the header and saves the cookie file on your computer hard drive
- Every other time you visit that website, your browser automatically sends the cookie back to the server

This process lets the website remember your login session, shopping cart items, preferences and settings, and other critical information.

The storage method introduces significant security risks. If a hacker gains physical access to your device or uses malware to read your local files, they can steal your session cookies.

With a stolen session cookie, an attacker can log into your accounts from a completely different computer without knowing your password.

To protect users and prevent cookie theft, developers use specific security flags when setting cookies:

The `HttpOnly` flag blocks JavaScript from reading the cookie file. This restriction prevents attackers from stealing your session tokens via Cross-Site Scripting attacks.

The `Secure` flag ensures the browser only transmits the cookie over encrypted HTTPS connections. This prevents bad actors from sniffing cookies on public Wi-Fi and in similar situations.

The `SameSite` flag restricts the browser from sending cookies during cross-site requests, which blocks Cross-Site Request Forgery attacks. It has two common values:

- `SameSite=Strict` prevents the browser from sending the cookie on any cross-site request.
- `SameSite=Lax` allows cookies on safe top-level navigation, such as clicking a link, but blocks them on cross-site form submissions and API requests.

Cookies also have massive privacy implications. First-party cookies only track your actions on the specific website you choose to visit. However, third-party cookies track you across entirely different websites.

Advertising networks place these cookies on thousands of popular sites. As you surf the net, the ad network reads the same third-party cookie repeatedly to build a detailed profile of your personal interests, search history, and online habits.

This invisible tracking creates a massive privacy concern because it allows corporations to monitor your digital life without your active knowledge.

Due to these threats, privacy laws like GDPR require websites to show cookie consent banners so you know what a website is doing with the cookies it is setting. These laws give you the legal right to reject tracking cookies.

In addition, modern browsers now block third-party tracking cookies by default to give users automated privacy protection.

# --questions--

## --text--

What is the complete process of how a website stores a cookie on your device?

## --answers--

The website sends a Set-Cookie header, the browser saves the cookie, and it is sent back on future visits.

---

The website requests permission, the user approves, and the cookie is stored in system memory.

### --feedback--

The server sends a header first, then the browser stores it for later use.

---

The browser automatically creates the cookie, and the website reads it directly from the hard drive.

### --feedback--

The server sends a header first, then the browser stores it for later use.

---

The website downloads the cookie, the user manually installs it, and the browser activates it later.

### --feedback--

The server sends a header first, then the browser stores it for later use.

## --video-solution--

1

## --text--

What is the main difference between first-party and third-party cookies?

## --answers--

First-party cookies require user permission, while third-party cookies do not require any consent.

### --feedback--

One stays on the site you choose, the other follows you across the web.

---

First-party cookies are always secure, while third-party cookies are always insecure.

### --feedback--

One stays on the site you choose, the other follows you across the web.

---

First-party cookies are stored in the browser, while third-party cookies are stored on the server.

### --feedback--

One stays on the site you choose, the other follows you across the web.

---

First-party cookies track your actions on the website you visit, while third-party cookies track you across different websites.

## --video-solution--

4

## --text--

What is the primary purpose of the `HttpOnly` flag when setting a cookie?

## --answers--

To encrypt the cookie value so only the server can decrypt it.

### --feedback--

Look out for the flag that stops malicious scripts from stealing your session tokens.

---

To block JavaScript from reading the cookie file.

---

To send the cookie only over HTTPS connections.

### --feedback--

Look out for the flag that stops malicious scripts from stealing your session tokens.

---

To prevent the cookie from being sent on cross-site requests.

### --feedback--

Look out for the flag that stops malicious scripts from stealing your session tokens.

## --video-solution--

2
