Cookies and server sessions
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
explain how a browser stays logged in with a session cookie.
Planned topics
- HTTP forgets you between requests; a session remembers you on the server.
- After login the server stores the session and sends a cookie holding only a random session ID.
- The browser sends the cookie automatically with each request.
HttpOnly: JavaScript cannot read the cookie.Secure: sent only over HTTPS.SameSite: limits sending on cross-site requests.- Server sessions are easy to revoke (delete the session) but need shared storage when you run many servers.
Draft outline details
Demonstration
a response header: Set-Cookie: SESSION=abc; HttpOnly; Secure; SameSite=Lax.
Check your understanding
Which attribute stops JavaScript from reading the cookie?
Show answer
HttpOnly.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.