How cookies work in PHP - Mechanics & Internals

Overview - How cookies work

What is it?

Cookies are small pieces of data that websites store on your computer through your browser. They help websites remember you, like keeping you logged in or saving your preferences. When you visit the site again, the browser sends these cookies back to the website. This way, the website can recognize you and provide a smoother experience.

Why it matters

Without cookies, websites would treat every visit as brand new, forgetting who you are each time. This would mean logging in repeatedly, losing shopping carts, and no personalized settings. Cookies solve this by storing small bits of information on your device, making the web feel more personal and efficient.

Where it fits

Before learning about cookies, you should understand how web browsers and servers communicate using HTTP. After cookies, you can explore sessions and authentication methods that build on cookie concepts to manage user identity securely.

Mental Model

Core Idea

Cookies are like name tags your browser wears to websites so they recognize you on return visits.

Think of it like...

Imagine going to a coffee shop where the barista gives you a small card with your name and favorite drink. Next time you come, you show the card, and they remember you instantly without asking again.

┌───────────────┐       ┌───────────────┐
│   Browser     │       │    Website    │
│               │       │               │
│  Stores cookie│◄──────│  Sends cookie │
│  Sends cookie │──────▶│  Sets cookie  │
└───────────────┘       └───────────────┘

Flow:
1. Website sends cookie to browser.
2. Browser stores cookie.
3. On next visit, browser sends cookie back.
4. Website reads cookie to recognize user.

Build-Up - 7 Steps

1

Foundation

What is a cookie in web terms

Concept: Introduce the basic idea of a cookie as a small data piece stored by the browser.

A cookie is a tiny text file that a website asks your browser to save. It usually contains information like a user ID or preferences. The browser keeps this file and sends it back to the website on future visits automatically.

Result

You understand that cookies are small data stored on your device by websites.

Understanding that cookies are simple text data stored by browsers is the foundation for all cookie-related concepts.

2

Foundation

How browsers and servers exchange cookies

Concept: Explain the HTTP headers used to send and receive cookies between browser and server.

When a server wants to store a cookie, it sends a 'Set-Cookie' header in its HTTP response. The browser saves this cookie. On later requests to the same server, the browser includes the cookie in the 'Cookie' header. This exchange happens automatically with every request and response.

Result

You see how cookies travel back and forth in HTTP headers.

Knowing the headers involved clarifies how cookies are passed without user action.

3

Intermediate

Setting cookies with PHP code

Concept: Learn how to create cookies in PHP using the setcookie() function.

This code tells the browser to save a cookie called 'user' with the value 'Alice'. The cookie will last for one hour.

Result

The browser receives the cookie and stores it for future requests.

Understanding how to set cookies in code is essential for controlling user experience.

4

Intermediate

Reading cookies in PHP scripts

Concept: Learn how to access cookie values sent by the browser in PHP.

This code checks if the 'user' cookie exists and greets the user accordingly.

Result

The script personalizes output based on stored cookie data.

Knowing how to read cookies lets your website remember users and customize content.

5

Intermediate

Cookie attributes and security flags

🤔Before reading on: Do you think cookies are always safe to store sensitive data? Commit to your answer.

Concept: Introduce cookie options like expiration, path, domain, Secure, and HttpOnly flags.

time() + 3600, 'path' => '/', 'secure' => true, // only send over HTTPS 'httponly' => true, // inaccessible to JavaScript 'samesite' => 'Lax' // restrict cross-site sending ]); ?> These options control when and how cookies are sent and improve security.

Result

Cookies become safer and more controlled in their behavior.

Understanding cookie attributes is key to protecting user data and preventing attacks.

6

Advanced

How cookies enable sessions and login states

🤔Before reading on: Do you think cookies store your password directly? Commit to your answer.

Concept: Explain how cookies store session IDs, not sensitive data, to keep users logged in securely.

Websites create a unique session ID and store it in a cookie. The server keeps user data linked to this ID. When the browser sends the cookie, the server knows who the user is without storing sensitive info in the cookie itself. This protects privacy and security.

Result

Users stay logged in without exposing passwords or personal data in cookies.

Knowing that cookies hold only session IDs prevents common security mistakes.

7

Expert

Cookie scope, conflicts, and browser behavior

🤔Before reading on: Can two different websites read each other's cookies? Commit to your answer.

Concept: Explore how domain, path, and browser rules isolate cookies and how conflicts are resolved.

Cookies are scoped by domain and path, so only matching URLs send cookies. Browsers prevent one site from reading another's cookies for privacy. If multiple cookies share a name but differ in path or domain, browsers send all matching cookies, and servers decide which to use. This can cause subtle bugs if not managed carefully.

Result

You understand cookie isolation and how to avoid naming conflicts.

Understanding cookie scope and browser rules helps prevent security leaks and bugs in complex sites.

Under the Hood

When a server responds, it includes a 'Set-Cookie' header with cookie data. The browser parses this header and stores the cookie in its internal cookie store, associating it with the domain and path. On subsequent requests to matching URLs, the browser automatically adds a 'Cookie' header with all relevant cookies. The server reads this header to identify the user or preferences. Browsers enforce rules to isolate cookies by domain and path and apply security flags to control cookie visibility and transmission.

Why designed this way?

Cookies were designed to work within the stateless HTTP protocol to provide a way to remember users between requests. Early web had no memory, so cookies added a simple, standardized method to store small data on the client side. The design balances simplicity, privacy, and security by limiting cookie size, scope, and access. Alternatives like URL rewriting were less secure and more cumbersome.

┌───────────────┐
│   Server      │
│  (sends Set-  │
│  Cookie header)│
└───────┬───────┘
        │
        ▼
┌───────────────┐
│   Browser     │
│ Stores cookie │
│ in cookie jar │
└───────┬───────┘
        │
        ▼
┌───────────────┐
│   Browser     │
│ Sends Cookie  │
│ header on    │
│ next request │
└───────┬───────┘
        │
        ▼
┌───────────────┐
│   Server      │
│ Reads Cookie  │
│ header to    │
│ identify user│
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do cookies store your password directly? Commit to yes or no.

Common Belief: Cookies store sensitive data like passwords so the website remembers you.

Reality: Cookies usually store only a session ID or token, not sensitive data like passwords.

Why it matters: Storing passwords in cookies risks theft and hacking, leading to security breaches.

Quick: Can one website read cookies set by another website? Commit to yes or no.

Common Belief: Cookies are shared across all websites you visit.

Reality: Cookies are isolated by domain; one website cannot read another's cookies.

Why it matters: Believing cookies are shared can cause privacy fears or incorrect debugging.

Quick: Do cookies last forever once set? Commit to yes or no.

Common Belief: Cookies stay on your device forever unless you delete them manually.

Reality: Cookies have expiration times and can be session-only, disappearing when the browser closes.

Why it matters: Misunderstanding cookie lifespan can cause bugs in user experience and data retention.

Quick: Does setting the Secure flag on a cookie mean it is encrypted? Commit to yes or no.

Common Belief: The Secure flag encrypts the cookie data itself.

Reality: The Secure flag only ensures the cookie is sent over HTTPS, not that the cookie content is encrypted.

Why it matters: Thinking Secure encrypts data may lead to false security assumptions.

Expert Zone

1

Cookies with the SameSite attribute help prevent cross-site request forgery (CSRF) attacks by controlling when cookies are sent.

2

Browsers limit the total number and size of cookies per domain, which can cause unexpected cookie eviction if limits are exceeded.

3

HttpOnly cookies cannot be accessed by JavaScript, reducing the risk of cross-site scripting (XSS) attacks stealing cookies.

When NOT to use

Cookies are not suitable for storing large amounts of data or highly sensitive information like passwords. Alternatives include server-side sessions, localStorage for non-sensitive client data, or secure tokens with short lifetimes. For strict privacy needs, consider token-based authentication without cookies.

Production Patterns

In real-world systems, cookies are used to store session IDs linked to server-side session stores. Secure and HttpOnly flags are always set for authentication cookies. SameSite=Lax or Strict is used to prevent CSRF. Cookies are rotated and invalidated on logout or timeout. Developers carefully manage cookie paths and domains to avoid conflicts in multi-subdomain applications.

Connections

HTTP Protocol

Cookies build on HTTP headers to add statefulness to the stateless protocol.

Understanding HTTP basics helps grasp how cookies fit into web communication.

Session Management

Cookies are the foundation for managing user sessions and login states.

Knowing cookies clarifies how sessions persist user identity across requests.

Human Memory and Recognition

Cookies mimic how humans remember people by recognizing a small token (like a face or name).

This cross-domain link shows how digital systems replicate natural recognition processes.

Common Pitfalls

#1 Storing sensitive data like passwords directly in cookies.

Wrong approach:

Correct approach:

Root cause:

Misunderstanding that cookies are secure storage rather than simple data holders.

#2 Not setting the HttpOnly flag on authentication cookies.

Wrong approach:

Correct approach:

true]);
?>

Root cause:

Lack of awareness about JavaScript access to cookies and XSS risks.

#3 Assuming cookies persist after browser closes without setting expiration.

Wrong approach:

Correct approach:

Root cause:

Not knowing the difference between session cookies and persistent cookies.

Key Takeaways

Cookies are small pieces of data stored by browsers to help websites remember users and preferences.

They work by exchanging HTTP headers between the server and browser automatically on requests and responses.

Cookies should never store sensitive data directly; instead, they hold session IDs that link to secure server data.

Security flags like HttpOnly, Secure, and SameSite are essential to protect cookies from common web attacks.

Understanding cookie scope, expiration, and browser rules is key to building reliable and safe web applications.