Cookies are text files that websites place on visitors'
computers to store a range of information, usually specific to that
visitor - or rather the device they are using to view the site -
like the browser or mobile phone.
They were created to overcome a limitation in web
technology. Web pages are 'stateless' - which means that they
have no memory, and cannot easily pass information between each
other. So cookies provide a kind of memory for web pages.
Cookies allow you to login on one page, then move around to
other pages and stay logged in. They allow you to set
preferences for the display of a page, and for these to be
remembered the next time you return to it.
Cookies can also watch the pages you visit between sites, which
allows advertisers to build up a picture of your interests.
The when you land on a site that shows one of their adverts - they
can tailor it to those interests. This is known as
'behavioural advertising'.
Almost all websites use cookies in some way or another, and
every page you visit in those sites writes cookies to your computer
and receives them back from it.
For a more detailed explanation of what cookies are, including a
searchable database of what cookies are set by different sites,
take a look at Cookiepedia - the knowledge
base that is all about cookies.
First Party Cookies
One of the key attributes of a cookie is its 'Host' - this is the
domain name of the site that ultimately sets the cookie, and
therefore is retrieved by on a subsequent visit.
If the host name is the same as the domain in the browser
address bar when it is set or retrieved, then it is a First Party
Cookie.
Third Party Cookies
If the host domain for a cookie is different to the one in the
browser bar when it was downloaded, then it is a third party
cookie.
These are typically used by advertising networks which display
adverts in multiple sites. Whenever you visit a site
displaying that company's adverts, their cookies are set and
retrieved from the browser. In this way the advertiser can
'track' the websites visited by that browser - and by inference
build up an understanding of what the person using the browser is
interested in.
Session Cookies
Session Cookies are only stored temporarily in the browser's
memory, and are destroyed when it is closed down, although they
will survive navigating away from the website they came from.
If you have to login to a website every time you open your
browser and visit it - then it is using a session cookie to store
your login credentials.
Persistent Cookies
As the name suggests, this type of cookie is saved on your
computer so that when you close it down and start it up again, it
will still be there. All persistent cookies do have an expiry
date, and if that expiry date is reached, it will be destroyed by
the computer. If the expiry date is not set, or is in the
past, then it is a session cookie.
However, there is no real limit on the expiry date - so it could
be set to be 20 years in the future. In addition, if you
revisit the website that served up the cookie, it will
automatically place an updated version on your computer - with a
revised future expiry date.
If you login into a website, then shut down your computer, start
it up again, and go back to the website to find you are still
logged in - then it is using a persistent cookie to remember
you.
Persistent cookies are also used to track visitor behaviour as
they move around a site, and this data is used to try and
understand what people do and don't like about a site so it can be
proved. This practice is known as Web Analytics. Since
Google started providing its own analytics technology free of
charge to website owners, almost all websites use some form of it -
although there are also paid-for services available to rival
Google's
Analytics cookies are probably the most common form of
persistent cookies in use today.
Secure Cookies
Secure cookies are only transmitted via HTTPS - which you will
typically find in the checkout pages of online shopping sites.
This ensures that any data in the cookie will be encrypted as it
passes between the website and the browser.
HTTPOnly Cookies
When a cookie has an HTTPOnly attribute set, the browser will
prevent any client script in the page (like JavaScript) from
accessing the contents of the cookie.
This protects it from cross-site-scripting (XSS) attacks, where
a malicious script tries to send the content of a cookie to a third
party website.