Roadmap › Networking & Hosting — How a Website Works, End to End › Module: HTTP and the Browser
Lessons in this course (12)
6. Cookies, sessions, caching and CORS
Intermediate★ Must knowLesson 6 of 12
Cookies — small key/value data the server asks the browser to store and send back:
| Attribute | Meaning |
|---|---|
HttpOnly | JavaScript can't read it (protects against XSS stealing it) |
Secure | Only sent over HTTPS |
SameSite=Lax/Strict/None | Controls sending on cross-site requests (CSRF protection) |
Domain, Path, Expires/Max-Age | Scope and lifetime |
Session — the server keeps data (in memory, Redis, SQL) keyed by a session id stored in a cookie. In a web farm, sessions must be shared (distributed cache) or the load balancer must use sticky sessions.
HTTP caching:
| Header | Effect |
|---|---|
Cache-Control: public, max-age=31536000, immutable | Cache for a year (fingerprinted static files like app.3f9a.js) |
Cache-Control: no-store | Never cache (sensitive pages) |
ETag + If-None-Match | Revalidate: server answers 304 Not Modified without a body |
Last-Modified + If-Modified-Since | Same with dates |
CORS — a browser rule: JavaScript on origin A may read responses from origin B only if B allows A via Access-Control-Allow-Origin. Non-simple requests send an OPTIONS preflight first.