| What are
cookies? |
Cookies help Web sites maintain user states.
This means that Web sites can "remember" information about
users to facilitate their preferences for a particular site,
transparent user passwords, and so forth. More specifically, cookies
allow Web sites (servers) to deliver simple data to a client (user);
request that the client store the information; and, in certain
circumstances, return the information to the Web site. |
| How do cookies
work? |
Cookies are small data structures delivered by
a Web site to a Web client. The Web site may deliver one or more
cookies to the client. The client stores cookie data in one or more
flat files on its local hard drive. In certain cases (determined by
the data in the cookie itself), the client returns the cookie to the
server that originally delivered it. |
| Why are cookies
useful? |
Cookies allow Web sites to maintain information
on a particular user across HTTP connections. The current HTTP
protocol is stateless, meaning that the server does not store any
information about a particular HTTP transaction; each connection is
"fresh" and has no knowledge of any other HTTP
transaction. "State" information is information about a
communication between a user and a server, similar in many ways to
frequent flyer profiles or option settings in desktop software. (For
example, a preference for aisle or window seats is cookielike
information that a frequent-flyer program might store about one of
its customers.) In some cases it is useful to maintain state
information about the user across HTTP transactions. |
| What kind of
client-side information can Web servers store? |
User information
may be stored in the cookie or in a database on the Web site. This
information may be provided by either the user or the Web site
provider. Some scenarios include the following:
- Jim is using a Web site that uses a
search engine metaphor. He enters and/or chooses search criteria
by clicking a list or entering a values in a field or form.
Cookies can be used to store or reference information on the
search criteria of Jim's request so that it can be passed to the
next page that will locate and display the results of Jim's
request.
- Anna is shopping at a particular Web
site that uses a shopping cart metaphor. She puts items into a
shopping cart by clicking a link or an "Add to Shopping
Cart" button. Cookies can be used to store or reference
information on the contents of Anna's shopping cart so that she
can conveniently purchase a cart full of items rather than one
item at a time.
- Kevin clicks around a Web site that
allows users to view articles for a small charge. Cookies can be
used to store or reference information about which articles he
has viewed (that is, a list of URLs) so that he can pay for them
all at once rather than each time he downloads an article.
- Carl fills out a Web form with his
name, address, and other information. Cookies can be used to
store or reference this information so that the next time Carl
visits the site, the information is automatically uploaded and
he doesn't have to provide it again. If the form contains
sensitive information such as a credit card number or a mailing
address, the cookies can be delivered over Secure Sockets Layer,
which encrypts the information as it travels between the client
and server.
- Charlie logs in to a Web site that
requires a user name and password. When Charlie's user name and
password pair is successfully verified, the server passes down a
cookie that functions as a "guest, pass" allowing him
access to certain areas of the Web site. After a set time
period, perhaps half an hour or a day, the guest pass expires
and Charlie must log in again.
Each of these examples illustrates one of
two things: Either the server provides information (as in the last
example) or the user provides information by taking some action,
such as clicking a link or button or filling out a
form. |
| Can cookies read
information from user's hard drive? |
No. Cookies can only store data that is
provided by the server or generated by an explicit user
action. |
| Can cookies be
used to gather sensitive information, such as a user's email
address? |
Cookies can be used to store any information
that the user volunteers. They cannot be used to gather sensitive
information such as the fields in a preference file. In this case,
however, the same information can just as easily (and with
potentially more objectionable privacy concerns) be stored on the
server by using a simple server-side application that stores user
information in a database. Cookies are passive files that are
delivered to the client, stored on the client's hard drive, and
returned in certain situations to the same server that provided the
information in the first place. |
| Where are cookies stored? |
Cookie data is stored unencrypted on the user's
hard drive (although during actual communication it is stored in
memory). The filename(s) could be different for each
platform. |
| How long do cookies last? |
A Web site may set an expiration date for a
cookie it delivers. If no expiration date is specified, the cookie
is deleted when the user quits their browser. |
| Can malicious sites read cookie information used by another site? |
Cookies are designed to be read only by the
site that provides them, not by other sites. |
| Can cookies be encrypted? |
While the cookie file itself is unencrypted on
the user's computer, it can be encrypted between the user's computer
and a Web site. Programmers can require that cookies be delivered
and received only in the context of a Secure Sockets Layer (SSL)
session. The SSL session handles the actual encryption of cookie
data. |
| What products support cookies? |
Netscape Navigator and Microsoft Internet
Explorer both support the use of cookies. |
| Does every browser implement cookies in the same way? |
Not necessarily. Because the use of cookies is
just becoming an official standard, there may be some subtle
differences that do not affect how they work. For instance, Netscape
uses a single file for all cookies, while Microsoft uses a folder
with a separate file for each cookie. |
| Are cookies being presented for standardization to a standards body? |
Yes. The State
Management subworking group of the Internet Engineering Task Force's
HTTP Working Group is currently working on creating a formal
Internet draft for a cookie specification. |
