IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Cookies & sessions — how a website remembers you
Maya logs in to her airline account and opens ten pages. She types her password only once. Your goal: explain how a site remembers you with a cookie and a session.
- The web forgets you after every request.
- A cookie is a small note your browser keeps and sends back.
- The session is the server's record of who you are.
- Whoever holds the cookie is you, as far as the server knows.
The web has no memory
In the last lesson a browser asked and a server answered, one request at a time. Each request is stateless. The server treats it as if it never met you. Ask for page 1, then page 2, and the server sees two strangers. After you log in, the site needs a way to say "it is you again."
The cookie
When you log in, the server gives your browser a cookie. It is a small note, usually a random code like session=abc123. The server sends it in a Set-Cookie header. Your browser keeps it. Then it adds the same note to every later request to that site, by itself.
The server keeps a matching record on its own side. That record is the session. It says "abc123 is Maya, logged in five minutes ago." When the cookie arrives, the server finds the session. Now it knows who you are.
a shoe stand at a temple. You hand over your shoes and get a numbered token. The token is the cookie. The shoes on the shelf are the session. You show the token, and the keeper finds your shoes by its number.
Cookie or session: who holds what?
| Cookie | Session | |
|---|---|---|
| Who holds it | Your browser, on your device | The server |
| What is inside | Usually just a random code (the token number) | The real facts: who you are, when you logged in, what you may do |
| If it is lost | You look logged out. Log in again. | The server forgets the login. Everyone with that cookie is logged out. |
| If it is stolen | The thief can pretend to be you. The code is the proof. | It stays on the server, so it cannot be copied from your device. |
Set-Cookie note (2). From then on her browser adds that cookie to every request (3). The server knows her (4), with no more passwords. Remove the cookie (5) and the server does not know who is knocking: 401.Maya signs in once. Then she opens bookings, seat, points and receipts. Each page load carries the same session=abc123 cookie. Each time, the server checks its list and thinks "still Maya." That invisible name-tag is why the web seems to remember you.
Whoever holds the cookie is you, as far as the server can tell. The server matches the code and asks nothing more. So stealing a cookie is a real attack (cookie theft). Later you will learn how to protect cookies (session security). You can mark them secret, tie them to one browser, and make them expire fast.
🧪 Interactive lab — enable JavaScript to play with this one.
See the real cookies a website sets, and whether they carry safety flags. Use Cookie Check.