Cookie

A cookie is a small key-value pair a server tells the browser to store, which the browser automatically attaches to every subsequent request to that site. Cookies are how stateless HTTP remembers who you are — most commonly holding a session ID.

Worked example: the server sends Set-Cookie: session=abc123; the browser stores it and sends Cookie: session=abc123 on every request, so the server recognizes the returning user. Gotcha: cookie security flags are critical — HttpOnly stops JavaScript reading it (defends against XSS token theft), Secure sends it only over HTTPS, and SameSite limits cross-site sending (defends against CSRF); a session cookie without these is a vulnerability, and cookies also carry privacy and consent obligations.