What are cookies?

You may have noticed that Web sites are getting smarter by the day. They seem to "know" more and more about you each time you visit. For instance, you may bookmark a popular site such as the Amazon or CDnow, and find that the computer on the other end knows not only that you've been there before, but exactly when you last visited, and what you were looking at the last time you clicked by. Spooky, you say? Exciting? Perhaps a little of both? Most Web sites accomplish this stunning feat with HTTP cookies. A cookie is a small piece of information that's sent to your browser - along with an HTML page - when you access a particular site. When a cookie arrives, your browser generally saves this information to your hard drive; when you return to that site, some of the stored information will be sent back to the Web server, along with your new request. Sites with "shopping carts" are a good example of cookies in action: You browse a series of Web pages for items to buy, and when you find something you want, you "add it" to your shopping cart by clicking a button on the page. Later, you can view these items all together. The funny thing is, even though you're communicating through an "anonymous" connection, the site always knows exactly what's in your personal shopping cart. It doesn't seem to matter whether you've clicked away to somewhere else and come back, or even if you've completely shut down your computer and returned days later. The site still knows who you are, and what you were shopping for. But how? Cookies work their magic by expanding the abilities of HTTP, so it's hard to talk about one without first explaining the other. HTTP (hypertext transfer protocol) is a group of standards that cover the way Web pages, graphics, and other data should be transferred across the Net. In other words, it's the rules of the road. Every server and browser on the Web uses this standard to communicate. A small HTTP header is sent with each transaction, telling the receiving end exactly what it's getting. These headers communicate requests from browsers, as well as server responses. A normal HTTP response header looks something like this: HTTP/1.0 200 FoundDate: Wed, 30 Oct 1996 23:48:22 GMT Server: Apache/1.1.1 HotWired/1.0 Location: http://www.hotwired.com/frontdoor/ Content: text/webmonkey/html This header (or something like it) is sent with every single file that comes to you through the Web. So why haven't you noticed? Well, the information contained inside a cookie isn't displayed. In fact, a cookie is designed to be invisible to the user. Your browser is smart enough to strip off the information and just give you the page you're looking for. One of the limitations of HTTP is that it's a "stateless" connection. It works more or less like a vending machine: You push a button, and if everything checks out (i.e., you have correct change), it gives you what you want. The vending machine doesn't know anything about you, except that you ordered a root beer and it served you one. There's not a lot of information going back and forth. The HTTP cookie is an attempt to make regular HTTP a little smarter by including more information inside the HTTP header. By adding a "Set Cookie: ...." line to the HTTP header, the server can deliver cookie information to your browser. Your Web browser then saves this information and sends it back to the server the next time you visit the same site. Through this system, a kind of "persistent state" can be maintained, even though there's no ongoing communication between your browser and the cookie-setting server. This opens up some possibilities that Webmasters will make use of. For instance, if a site is looking to track the number of unique visitors over a period of time, the Webmaster will write a script that plants a cookie during the first visit. At subsequent visits, the script will see that the cookie is already there and will do nothing. This is a very simple example. A clever coder can use cookies to track user behavior over a period of time or to maintain a shopping cart.