Cookie
A mechanism in the HTTP protocol for storing session state on the client side. Servers can use cookies to identify user identity and maintain login state.
Core Facts
Timeline (last 90 days)
A session token is a temporary credential issued by the server after a user successfully logs in, usually stored on the client as a Cookie or JWT, with an expiration period after which re-authentication is required.
Mainstream browsers are gradually phasing out third-party cookies and introducing stricter privacy protection mechanisms.
Even after clearing all cookies and using incognito mode, fingerprinting can still re-associate users.
Setting a cookie expiration period to 20 years is practically equivalent to never expiring.
Session cookies expire when the browser is closed, while persistent cookies are typically set to last anywhere from a few days to one year.
Overly long cookies are often the result of unreviewed default settings from analytics tools or CDNs, rather than the product of explicit design intent.
The longer a tracking identifier persists, the more easily it can be combined with other datasets to re-identify individuals.
Cookies and tokens are the core credentials by which websites identify logged-in users, and holders can fully simulate a user's logged-in state until the token expires.
Unlike passwords, Cookie/Token leaks typically do not trigger secondary verification prompts such as 'unknown device,' making them harder for account holders to detect immediately.
In the cookie-swap approach, the save-and-restore-original-credentials process upon exiting impersonation itself constitutes an attack surface that may lead to session confusion or privilege escalation.
7 more timeline events
All Facts (17)
A Session Token is an encrypted credential generated by a web application after a user logs in, stored in the browser's Cookie, used to verify the user's identity without requiring repeated password entry.
70%UnverifiedA session token is a temporary credential issued by the server after a user successfully logs in, usually stored on the client as a Cookie or JWT, with an expiration period after which re-authentication is required.
50%UnverifiedMainstream browsers are gradually phasing out third-party cookies and introducing stricter privacy protection mechanisms.
50%UnverifiedEven after clearing all cookies and using incognito mode, fingerprinting can still re-associate users.
50%UnverifiedOverly long cookies are often the result of unreviewed default settings from analytics tools or CDNs, rather than the product of explicit design intent.
50%UnverifiedSession cookies expire when the browser is closed, while persistent cookies are typically set to last anywhere from a few days to one year.
50%UnverifiedSetting a cookie expiration period to 20 years is practically equivalent to never expiring.
50%UnverifiedThe longer a tracking identifier persists, the more easily it can be combined with other datasets to re-identify individuals.
50%UnverifiedCookies and tokens are the core credentials by which websites identify logged-in users, and holders can fully simulate a user's logged-in state until the token expires.
50%UnverifiedUnlike passwords, Cookie/Token leaks typically do not trigger secondary verification prompts such as 'unknown device,' making them harder for account holders to detect immediately.
50%UnverifiedThe user impersonation approach recommended by most web frameworks is to swap cookies, i.e., replacing the current session cookie with the target user's session cookie
50%UnverifiedCookies are credential carriers automatically managed by the browser and automatically attached to requests
50%UnverifiedIn the cookie-swap approach, the save-and-restore-original-credentials process upon exiting impersonation itself constitutes an attack surface that may lead to session confusion or privilege escalation.
50%UnverifiedBrowser cookies are small text credentials issued by the server to the client, used to maintain session state on top of the stateless HTTP protocol.
50%UnverifiedData in localStorage is not automatically sent to the server with each HTTP request, and persists even after closing the browser or restarting the computer.
50%UnverifiedUnlike cookies, data in localStorage is not automatically sent to the server with HTTP requests, and the data persists even after closing and reopening the browser.
50%UnverifiedsessionStorage 是会话级存储，关闭标签页即失效；Cookie 容量小且会随 HTTP 请求发送到服务器
50%