All About Cookies

What are cookies?
How do cookies work?
Why are cookies useful?
How has the implementation of cookies changed from the early browsers to Communicator 4.0?
What kind of client-side information can Web servers store?
Can cookies read information from a user's hard drive?
Can cookies be used to gather sensitive information, such as a user's email address?
Where are cookies stored?
Can programmers save client state information without cookies?
How long do cookies last?
Can malicious sites read cookie information used by another site?
Can cookies be encrypted?
What products support cookies?
Does every browser implement cookies in the same way?
Are cookies being presented for standardization to a standards body?

What are cookies?
Cookies help Web sites maintain user states. This means that Web sites can "remember" information about users to facilitate their preferences for a particular site, transparent user passwords, and so forth. More specifically, cookies allow Web sites (servers) to deliver simple data to a client (user); request that the client store the information; and, in certain circumstances, return the information to the Web site.

How do cookies work?
Cookies are small data structures delivered by a Web site to a Web client. The Web site may deliver one or more cookies to the client. The client stores cookie data in one or more flat files on its local hard drive. In certain cases (determined by the data in the cookie itself), the client returns the cookie to the server that originally delivered it.

Why are cookies useful?
Cookies allow Web sites to maintain information on a particular user across HTTP connections. The current HTTP protocol is stateless, meaning that the server does not store any information about a particular HTTP transaction; each connection is "fresh" and has no knowledge of any other HTTP transaction. "State" information is information about a communication between a user and a server, similar in many ways to frequent flyer profiles or option settings in desktop software. (For example, a preference for aisle or window seats is cookie-like information that a frequent-flyer program might store about one of its customers.) In some cases it is useful to maintain state information about the user across HTTP transactions.

How has the implementation of cookies changed from the early browsers to Communicator 4.0?
In Navigator 1.0x through 2.0x, the cookie preferences could not be set by the user. These versions of Navigator default to accept all cookies.

In Navigator 3.0x, the user can choose to be warned before a cookie is set. As a result, when a cookie is set, the user sees a dialogue box that offers the option of accepting or rejecting that particular cookie request. This preference is found in the Options menu, under Network Preferences, Protocols. The default option is to accept all cookies without a warning.

In Communicator 4.0x, the user sees the following cookie choices:

• Accept all cookies
• Accept only cookies that get sent back to the originating server
• Disable all cookies
• Warn me before accepting a cookie

These choices are in the Edit menu, under Preferences, Advanced. Communicator 4.0 defaults to accept all cookies.

What kind of client-side information can Web servers store?
User information may be stored in the cookie or in a database on the Web site. This information may be provided by either the user or the Web site provider. Some scenarios include the following:

• Alice is shopping at a particular Web site that uses a shopping cart metaphor. She puts items into a shopping cart by clicking a link or an "Add to Shopping Cart" button. Cookies can be used to store or reference information on the contents of Alice's shopping cart so that she can conveniently purchase a cart full of items rather than one item at a time.

• Bob clicks around a Web site that allows users to view articles for a small charge. Cookies can be used to store or reference information about which articles he has viewed (that is, a list of URLs) so that he can pay for them all at once rather than each time he downloads an article.

• Carl fills out a Web form with his name, address, and other information. Cookies can be used to store or reference this information so that the next time Carl visits the site, the information is automatically uploaded and he doesn't have to provide it again. If the form contains sensitive information such as a credit card number or a mailing address, the cookies can be delivered over Secure Sockets Layer, which encrypts the information as it travels between the client and server.

• Don logs in to a Web site that requires a user name and password. When Don's user name and password pair is successfully verified, the server passes down a cookie that functions as a "guest, pass" allowing him access to certain areas of the Web site. After a set time period, perhaps half an hour or a day, the guest pass expires and Don must log in again.

Each of these examples illustrates one of two things: Either the server provides information (as in the last example) or the user provides information by taking some action, such as clicking a link or button or filling out a form.

Can cookies read information from a user's hard drive?
No. Cookies can only store data that is provided by the server or generated by an explicit user action.

Can cookies be used to gather sensitive information, such as a user's email address?
Cookies can be used to store any information that the user volunteers. They cannot be used to gather sensitive information such as the fields in a Netscape preference file. In this case, however, the same information can just as easily (and with potentially more objectionable privacy concerns) be stored on the server by using a simple server-side application that stores user information in a database. Cookies are passive files that are delivered to the client, stored on the client's hard drive, and returned in certain situations to the same server that provided the information in the first place.

Where are cookies stored?
Cookie data is stored un-encrypted on the user's hard drive (although during actual communication it is stored in memory). The filename is different for each platform. For example, on Windows machines, cookie data is stored in a file called COOKIE.TXT.

Can programmers save client state information without cookies?
Yes. Client state information can be stored in several ways. For example, server administrators and programmers can create a database application that tracks and stores data they would otherwise have managed with cookies. Cookies are simply a programming convenience.

How long do cookies last?
A Web site may set an expiration date for a cookie it delivers. If no expiration date is specified, the cookie is deleted when the user quits Netscape Navigator.

Can malicious sites read cookie information used by another site?
Cookies are designed to be read only by the site that provides them, not by other sites.

Can cookies be encrypted?
While the cookie file itself is un-encrypted on the user's computer, it can be encrypted between the user's computer and a Web site. Programmers can require that cookies be delivered and received only in the context of a Secure Sockets Layer (SSL) session. The SSL session handles the actual encryption of cookie data.

What products support cookies?
Netscape Navigator has supported cookies since version 1.0. Internet client products from companies such as Microsoft also support cookies.

Does every browser implement cookies in the same way?
Not necessarily. Because the use of cookies is just becoming an official standard, there may be some subtle differences that do not affect how they work. For instance, Netscape uses a single file for all cookies, while another company uses a folder with a separate file for each cookie.

Are cookies being presented for standardization to a standards body?
Yes. The State Management subworking group of the Internet Engineering Task Force's HTTP Working Group is currently working on creating a formal Internet draft for a cookie specification. In Communicator 4.0, Netscape has added the portion of the IETF specification that provides users with the ability to reject cookies that are not sent to the originating server. This enables users concerned with privacy to reject the placement of cookies by advertisers that track users on a variety of sites and send the information back to their corporate server.

RETURN TO TECHNICAL ARCHIVE INDEX