1. Cookies Tutorial
Cavisson Systems Inc.

2. Cookies
HTTP is a stateless protocol. Each HTTP request is processed without any knowledge of previous requests. 
Cookies are used to provide the server some information about the user's session or past requests
The server is responsible for setting up the cookies. It sets a cookie by using a header in the HTTP response message.
Every cookie will have a name and a value. It also can have an expiry date, path, secure and a host name. The server sends a cookie with all or some of the mentioned parameters along with the HTTP response.
It is up to the server as to what time a cookie should be set.

3. Contd.
When a person logs in, the server will remember by sending a cookie with a name and a value in a HTTP response. Browser has to just select all the cookies set by that particular server and then sends it with the subsequent HTTP request through the Cookie header. The server now gets the encoded data sent as a cookie name and value. The server can match these values with the values in the database and thus will be able to remember the login details.
The cookies are used in session management and state management.
Server sends an expiry date. After the expiry time is reached the session gets expired. It works like time out. If there is no expiration date specified by the server then the cookie is valid only for that session or till the browser is alive. This cookies is called as “In-memory Cookie or Session Cookie”. When a expiration date is specified then the cookie is called as “ Session Persistent Cookie”.
Also the server sends a host or domain name for e.g. yahoo.com
A path can also be given by the server. For e.g. the server can set for \home and then the browser will send that cookie associated with \home.
Secure flag has a default value of NO. This means that the cookie is not valid for secure connections and if the secure is flag is set to YES by the server then that means that the client can send the cookie to secure connection by using the HTTPS protocol. So the client could send the cookie to if the secure flag is set to YES.
Session Persistent Cookies data is stored on the user’s hard-disk. However when communication is required between the client and the server then the cookies are brought to memory.

4. Contd.
In the above figure the server is setting up cookies using the Set-Cookie header.

5. Contd.
In the above figure in the HTTP request side the cookies are collected and sent to the server. In the HTTP response side the value of the already set cookies is updated with new values and expiration date and time. Also some more new cookies are set by the server.