-2

Hello I have a question that I can't seem to find an answer. In web development.

So what is the difference between cookie authentication system when you register/login, your credentials to be stored in a cookie and the pop up box that says - Wants you to accept its cookies. Are these two separated cookies? I am confused.

user18022537
  • 3
  • 3

2 Answers2

0

A server can send a Set-Cookie response header to ask the browser to store some data in a cookie.

This is often a token (such as a session ID or a JWT) which marks the user as being logged into the site.

It can also be a tracking token which is used to track your activity across different sites for, for example, marketing purposes.

(Or it can be various other things, but those are the most common).

Some browsers can be configured to prompt the user before a cookie is stored. This can display a built-in prompt to confirm it. (I'm not sure if any support remains in modern browsers, cookies are so common that prompts would be very intrusive, but this is the config for IE6:)

IE6 privacy settings

Some countries have regulations which require the user grant permission before they are tracked. This is often conflated with cookies (and is often called "cookie laws") but the regulations apply to tracking not to the technology used to do the tracking.

Sites will therefore often display a notice asking the user to accept the cookies. They very frequently use dark patterns to make it annoying to refuse and easy to accept by accident.

Here is Stackoverflow's example. You can see that you can accept the cookies with one click or go to a customise page (one click) and then confirm the default choices (a second click) or accidentality click the "accept all cookies" button next to it).

Stackoverflow cookie permissions Stackoverflow customise cookie permissions

Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335
-1

Credentials are not stored in cookies. Cookie store a session id that is used to retrieve session id.

But cookies can also be used for many others purposes.

But in fact that is the same.

JoelCrypto
  • 462
  • 2
  • 12
  • "Credentials are not stored in cookies" — They *can* be, although it isn't good practise. – Quentin May 29 '22 at 20:06
  • "Cookie store a session id" — They *can* … but frequently don't. – Quentin May 29 '22 at 20:06
  • "But in fact that is the same." — This doesn't make sense. You seem to be saying that "session ids" and "other purposes" are "the same thing" which isn't possible. – Quentin May 29 '22 at 20:07
  • A cookie is a cookie… and php sessions relies on a cookie id. – JoelCrypto May 29 '22 at 20:09
  • The question doesn't mention PHP, and PHP doesn't depend on cookies to handle it sessions. You can turn on [transparent sid support](https://www.php.net/manual/en/session.configuration.php#ini.session.use-trans-sid) and use that instead (although doing so isn't a good idea). – Quentin May 29 '22 at 20:11
  • It is possible but it is rare and hopefully. And most sessions are done with PHP this is why i answered about PHP. Basically if you block all cookies, all is blocked, sessions and trackers. – JoelCrypto May 29 '22 at 20:14