Sessions and cookies
The cookie and its Set-Cookie and Cookie headers, its attributes (lifetime, scope, Secure, HttpOnly, SameSite), the server-side session and its identifier, and how to open, regenerate and destroy a session.
- 30 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
- Understand
A few cards from the deck
Cookie: what is it?
Show the answer
A small name=value piece of data that the server asks the browser to keep, and that the browser sends back with each request to the same site.
It is what gives a memory to a stateless protocol. The server sets it with
Set-Cookie, the browser sends it back withCookie.The browser receives this header from
boutique.example. For which pages does it attach the cookie?
```text
Set-Cookie: panier=3; Path=/admin`/adminand/admin/stats, but not/panier- Only
/admin, Path requiring the exact path - Every page of the site, Path only governing writing the cookie
/admin,/admin/statsand/administrateur, the/adminprefix being enough
Show the answer
/adminand/admin/stats, but not/panierPathcovers the given path and its sub-paths, not paths that merely start with the same letters:/administrateuris not included.Pathlimits sending, but protects nothing against another script on the same site.The server sets a cookie with the … response header; the browser then sends it back in the … request header.
Show the answer
The server sets a cookie with the Set-Cookie response header; the browser then sends it back in the Cookie request header.
Set-Cookie: sid=a1b2c3; HttpOnlyon the way out,Cookie: sid=a1b2c3on the way back: only the name=value pair returns, without attributes.Session: what is it?
Show the answer
A set of data held by the server for a given visitor: who is logged in, what their basket holds, between two requests.
The data stays on the server, the user cannot change it. The browser only has a key to find it: the session identifier.