Cookies · Sessions
Cookie / Session
What is a cookie?
- Cookie = information stored in the browser
- Session = state the server remembers
- Helping the web remember who's who
What cookies and sessions really change is not the feature of 'remembering the user' but the design decision of where to keep that memory. If you send the information along with the browser, the server stays light, but users can open and edit it. If the server holds it, it's safer, but you take on storage and expiry management for every concurrent user. That is why a single stay-logged-in feature touches security, server cost, and infrastructure design all at once.
Cookies come in several kinds. Session cookies disappear when you close the browser, while persistent cookies carry an expiry date (Max-Age) and last for weeks. First-party cookies, set by the site you visit, and third-party cookies, set by ad companies, are entirely different in nature. Each cookie is limited to roughly 4 KB, so they aren't meant to hold data wholesale. Instead, how you set attributes is the real security line: HttpOnly (blocks JavaScript access), Secure (sends only over HTTPS), and SameSite (restricts sending on cross-site requests).
Sessions can also be stored in different ways: the traditional approach of keeping them in server memory, pooling them in a shared store such as Redis, or putting the state inside a signed token (JWT) so the server stores nothing. The moment you scale to multiple servers, this choice shows up as an outage. Tokens scale easily, but the tradeoff is that an issued token is hard to invalidate immediately, so requirements like blocking a departed employee's account call for extra mechanisms.
The most common misconception in practice is that “showing a cookie consent banner takes care of privacy compliance.” If you bundle the essential cookies that keep users logged in with advertising tracking cookies and collect only a blanket “accept all,” tracking scripts keep running even for users who declined, and you can be flagged for collecting data without consent. Conversely, many companies are alarmed by the third-party cookie phase-out and start worrying about their own login, but that concerns cookies from someone else’s domain. One more: if you turn on “stay logged in for 30 days” for convenience and leave out HttpOnly, a single line of script can steal the entire session cookie.
Jaryong KooMarketing PhD and authority in AI, data analytics, and personal branding
John KimAuthor of B2B Marketing Design and CEO of Nanum ConsultingThe web cookie was devised in 1994 by Lou Montulli of Netscape. It was a way to let 'stateless' HTTP remember users.
Consider a hypothetical case: Company A, an online household goods retailer with about KRW 40 billion (≈ US$29,926,700) in annual revenue and 120 employees. The week after it scaled its web servers from 1 to 3 to prepare for peak season, it began receiving 40 customer inquiries a day saying, “I add items to my cart, click checkout, and get logged out.” Over 3 weeks, its checkout conversion rate fell from 2.1% to 1.4%.
- Team Lead Kim on the development team dug through the logs and found that each of the 3 servers was holding sessions in its own memory. "You can log in on server 1, but if your next request goes to server 3, it has never seen you before."
- Assistant Manager Park in infrastructure enabled session stickiness on the load balancer that same evening, cutting inquiries from 40 a day to 6, but a limit remained: restarting even one server logs out every customer pinned to it.
- Two weeks later, they added a Redis session store so all 3 servers see the same sessions, and standardized on 30-minute idle expiry and re-authentication only at the payment step.
- Manager Lee on the marketing team reported, "Ad tags still fire for customers who decline cookie consent." The team split consent into two options, essential cookies versus advertising and analytics cookies, and changed the setup so that scripts don't load at all when consent is declined.
- A security review found that the login cookie was missing HttpOnly and Secure, so the team added both attributes and shortened the 30-day auto-login to 14 days.
- A month later, login-related inquiries had fallen from 40 a day to 2, checkout conversion had recovered from 1.4% to 2.3%, and cart abandonment had dropped from about 900 a week to 380.