Session Cookie

A session cookie is a small piece of data a website asks your browser to hold for the duration of one visit and then throw away when the browser closes. What makes it a session cookie is the absence of an expiry date. Because no Expires or Max-Age value is set, the browser keeps the cookie in memory rather than writing it to disk, so it disappears when the window or tab shuts. The web itself is stateless, meaning each request to a server arrives with no memory of the last one. A session cookie fixes that by carrying a small identifier — often a session ID — that the server matches to what it already knows about you, stitching a run of separate requests into one continuous visit.

Session cookies do the quiet work that makes an interactive site feel like a single conversation. When you sign in, a session cookie usually holds the token that keeps you logged in as you move from page to page. When you drop items into an online cart before creating an account, a session cookie remembers what is in the basket. Without it, every click would land as a stranger, and you would have to prove who you are on each page. Because the cookie is discarded at the end of the visit, it is well suited to short-lived, sensitive state — the kind you want gone the instant someone walks away from a shared or public computer. The safest mental model is to judge a cookie by what it does, since the very same login cookie is critical on a bank and merely handy on a blog.

The clean contrast is with the persistent cookie. A persistent cookie carries an explicit expiry date, so the browser saves it to disk and hands it back on future visits — for days, months, or years — until it expires or is cleared. A session cookie has no such date and never survives the browser closing. The distinction is functional, not just technical. A "remember me" checkbox writes a persistent cookie so you stay recognized next week, while the live logged-in state during today's visit is typically a session cookie that ends when you leave. Language preferences and long-term analytics identifiers lean on persistent cookies, whereas one-visit essentials such as a shopping session or a checkout step lean on session cookies.

Both kinds can be first-party (set by the site you are on) or third-party (set by another domain), and both can be marked with flags that matter for safety and privacy. Do not confuse a session cookie with browser sessionStorage, a separate mechanism the server never receives automatically. Under privacy law, strictly necessary session cookies that keep a login or cart working usually need no consent, while tracking cookies — often persistent — generally do. So the session-versus-persistent split maps loosely onto the essential-versus-tracking split, though not perfectly, since a session cookie can still be used for measurement within a single visit.

Handle session cookies as the guardians of a live login, because whoever holds a valid session identifier is treated as that user. Mark session cookies that carry authentication as HttpOnly, so page scripts cannot read them and a cross-site scripting flaw cannot steal them, as Secure, so they travel only over HTTPS, and with a sensible SameSite value to blunt cross-site request forgery. Keep almost nothing in the cookie itself — store a short opaque session ID and hold the real data server-side, so the cookie is a claim ticket rather than a filing cabinet. Regenerate the session identifier when a user logs in, which defeats session fixation, where an attacker plants a known ID before sign-in.

The common failures are treating a session cookie as if it were durable and expecting a cart or a login to outlive the browser, which frustrates users who reopen the site and find themselves logged out. Others stuff sensitive data straight into the cookie, forget the Secure and HttpOnly flags, or let a single session live far too long without re-authentication. The discipline is the reverse — keep session cookies small, flagged, and short-lived, back them with server-side state, rotate their identifiers at login, and reach for a persistent cookie only when you deliberately want something remembered after the visit ends. Treated that way, the humble session cookie stays a quiet convenience rather than a security liability.

A session cookie is a browser cookie with no expiry date, held in memory and deleted when the browser closes, so it keeps single-visit state such as a login or cart alive, in contrast to a persistent cookie that survives across visits.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where session cookie is a core concern: