SPRING CONCEPTS
Cookie
Spring Concepts / Cookie
A cookie is data a browser stores and sends on matching HTTP requests.
Understand the idea
The response’s Set-Cookie header establishes it; later requests include it in Cookie. JSESSIONID identifies the server session in this lab. HttpOnly limits script access, while Secure requires HTTPS for transmission; they have different purposes.
A concrete example
Set-Cookie: JSESSIONID=...; HttpOnly
Cookie: JSESSIONID=...In the application
Tomcat’s session cookie links browser requests to the session-held todo list.
The todo objects are server-side, not inside JSESSIONID. Session cookies do not create authenticated user accounts by themselves.