Understanding Cookies

This article is for the baffled, the bewildered, the perplexed.

It clarifies the concept of cookies, never again to be confusing.

The World Without Cookies

To better appreciate the significance of cookies, let's have a look at what the Internet world is like without cookies.

Browsers

When a browser visits a website, a log entry is created. The record contains the date and time, the type of browser and operating system, the page the browser requested, and other pertinent information.

But no information is logged that individually identifies the browser.

A server log might contain this information:

24 Aug 09 10:34:03
     IE8 on PC
          index.html
               11.22.33.44
24 Aug 09 10:34:05
     IE7 on PC
          book.html
               44.55.66.77
24 Aug 09 10:34:07
     Firefox on Mac
          index.html
               55.66.77.88
24 Aug 09 10:34:07
     Firefox on Mac
          index.html
               55.66.77.88
24 Aug 09 10:34:13
     IE7 on PC
          book.html
               44.55.66.77

If a browser reloads the page at a website or looks at a different page, the server does not know it is the same browser as before.

The type of browser and operating system may be the same. The IP address may be the same. Yet, there are many such browsers and many such operating systems. And many computers may provide the same IP address.

Considering certain log records to be made by the same browser is only an assumption. Even if the assumption happens to be correct, there is no corroboration and no individual browser identification.

People

As an aid to understanding, imagine a convention with a thousand booths and a million visitors. If a booth made a log similar to a server log of all who looked at a product or picked up a flyer, it might read something like this:

24 Aug 09 10:34:03
     Female with white blouse
          Picked up flyer
               Jane
24 Aug 09 10:34:05
     Male with blue shirt
          Picked up flyer
               Joe
24 Aug 09 10:34:07
     Male with green shirt
          Looked at widget display
               Mike
24 Aug 09 10:34:07
     Female with green blouse
          Looked at widget display
               Marie
24 Aug 09 10:34:13
     Male with blue shirt
          Picked up flyer
               Joe

If a person comes back to the same booth at the convention, the person is not recognized with certainty as the same who visited earlier.

Some assumptions can be made.

The "Male with blue shirt" and the name "Joe" may be the same person in both instances, perhaps picking up a second flyer for a friend or because he gave the first away or lost it.

The "Male with green shirt" and "Female with green blouse" may be a couple. They both wear the same color and they both visit the booth within the same second.

However, those are assumptions. Even if correct, there is no corroboration and no personally identifying information.

The World With Cookies

Cookies were invented so the browser could identify itself to the server as the same browser that was there before and to provide information given to it earlier. (Their geek name is "Persistent Client State HTTP Cookies." See the "HTTP Cookies specification" page)

A cookie can be likened to a data card.

Browsers

The website gives the cookie to the browser and the browser accepts it. Domains do not keep the cookies, although they may keep a record of cookies they gave to browsers.

A domain can give a browser up to 20 cookies. Each cookie can be up to 4k in size.

When the browser reloads the page or comes back to the domain sometime in the future, it reveals cookies it was given earlier.

This is the thing: Browsers reveal cookies only to the domain that gave it to them. (There are restrictions related to subdomains, server paths, and expiration dates. But those details are unnecessary for a conceptual understanding of cookies.)

The cookie can contain any data that can be stored as plain text. Examples are:

Number of pages viewed.
Subscription form already has been displayed.
File name of shopping cart items.
Personal name or ID.
Search term used to find the page.

Because of the nature of cookies — being held by the browser and not by the domain — cookies can be shared with the domain only by the very same browser they were given to. Not by other browsers, nor even other browsers on the same computer.

When the domain sees the cookie, it knows the browser is the same one that was given the cookie in the first place. It can then act on that information as it is programmed to do.

People

Let's continue the trade show example for a better conceptual understanding of cookies.

Let's suppose everyone who visits a certain booth is given a card. On the card is stamped the time and what they did when they visited the booth.

If the same person comes back to the booth, they show their card.

If they previously "picked up flyer," they are directed to the widget display. However, if they already "looked at widget display," they are given a sales pitch.

The cookie lets the booth make less mistakes by pitching only to those who have already seen the widget, not to those who have only picked up a flyer or who have never visited the booth before.