#BackToBasics: HTTP Cookies
summary
Explains HTTP cookies as a protocol using Set-Cookie/Cookie headers (not just files), and how browsers store and send name/value pairs by domain and path without checking ports. Describes HttpOnly blocking document.cookie but leaving other cookie data accessible to JS, Secure restricting send to HTTPS, Public Suffix List preventing setting on public TLDs, the __Secure-/__Host- prefixes and SameSite attribute for reducing CSRF, and how third-party requests plus Referer enable easy tracking.
AI-written summary · about
chapters (11)
- 0:00HTTP cookies importance
- 3:20Montulli and 1994 cookies
- 9:22How cookies work
- 17:01Cookie attributes and sharing
- 26:41Cookie security and standards
- 35:30Web origins and isolation
- 37:57CSRF attacks and fixes
- 42:23Anti-tracking attributes
- 43:26Privacy and cookie abuse
- 51:04Ethics and web economics
- 53:13Conclusion & Q&A
