How are cookies passed in the HTTP protocol?

In the HTTP protocol, the transmission of cookies primarily relies on the Set-Cookie and Cookie fields within HTTP request and response headers. Here, I will provide a detailed explanation of this process, illustrated with an example.

1. Server Sets Cookies

When a user first visits a website, the server may decide whether to set one or more cookies on the user's device. If required, the server includes a Set-Cookie header in its HTTP response. This header contains the cookie's name, value, and other optional attributes such as Max-Age, Domain, Path, and Secure.

Example:

Assume a user visits an e-commerce website, and the server sends the following response header to track the user's session:

shell
HTTP/1.1 200 OK
Content-type: text/html
Set-Cookie: session_id=123456; Path=/; HttpOnly

Here, the Set-Cookie header instructs the browser to set a cookie named session_id with the value 123456 on the user's device, which is accessible only via HTTP (indicated by HttpOnly).

2. Browser Stores and Transmits Cookies

Once the cookie is set, it is stored in the user's browser. Subsequently, whenever the user makes a request to the same domain, the browser automatically sends the stored cookie via the Cookie request header to the server. This enables the server to identify returning users or maintain the user's session state.

Example:

If the user revisits a different page of the aforementioned e-commerce website, the browser sends the following request:

shell
GET /cart HTTP/1.1
Host: www.example.com
Cookie: session_id=123456

In this request, the Cookie header includes the previously set session_id information, allowing the server to identify the user or extract relevant session details.

3. Updating and Deleting Cookies

The server may choose to update or delete cookies. Updating requires only sending the Set-Cookie header again. If the server needs to delete a cookie, it typically sets the cookie's expiration time to a past date.

Example:

If the server needs to delete the aforementioned session_id cookie:

shell
Set-Cookie: session_id=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT

Summary

Through the Set-Cookie and Cookie headers in the HTTP protocol, the server can effectively set, update, transmit, and delete cookies in the user's browser to support various website functionalities such as session management, user tracking, and personalized settings. This mechanism is a critical component of website interaction.