Cookies: the cloakroom ticket a website gives its visitor
The Cookie Hotel announced its grand opening. Greg was at reception, a queue of guests stood behind him, and a sign above the desk read: “A ticket for everyone. Even if you're only asking the time.” The owner promised that the new system would never forget a guest. Then the receptionist asked his own wife for her surname. 🍪🤣
Good morning. Have we met?
— Good morning, I stayed here yesterday — announced a guest.
— Your ticket, please — replied Greg.
— But you can see me!
— I can. Yesterday I saw four hundred people. One tried to carry a television out in a suitcase.
— How will you recognize me?
— Keep this ticket. Next time, your browser can show it automatically.
That's roughly how a cookie works. It's a small piece of data a browser stores at the request of a website or server. On suitable later requests, the browser may send it back. This helps a site recognize a browser or a session, even though each HTTP request does not inherently remember the previous one.
— Will you remember my name?
— That depends on what's on your ticket and what's stored in our hotel records.
— What if it only has a number?
— Then I'll look up the details in our register. We don't carry the entire guest list in our pockets.
A ticket is not the whole room
The bell at reception rang.
— I'd like my suitcase back — said the guest.
— Number?
— SESSION-472.
Greg checked the register.
— Ah, room 23. Your suitcase is in the cloakroom.
In many systems, a cookie holds a session identifier while information about the signed-in user lives on the server. Other cookies may store a language choice or certain preferences. A cookie doesn't always mean a login, and it doesn't necessarily contain a name or password.
— Could someone put the actual password on the ticket?
— People can do all kinds of foolish things — Greg muttered. — That doesn't mean they should.
Session identifiers also need protection. If someone steals one, they may attempt to impersonate the guest. Websites therefore use protections such as Secure, HttpOnly and SameSite.
Two kinds of tickets
Agnieszka approached the cloakroom.
— I'd like a ticket that remembers I prefer a room overlooking the garden tomorrow.
— Certainly. This one has an expiry date.
— And the other one, without a date?
— That's for the current session.
Session cookies usually last for a browser session, although session restoration can make them survive a window being closed. Persistent cookies have a defined lifetime and may remain on the device longer. They aren't eternal: the browser or user may delete them earlier.
— So the hotel will recognize me tomorrow?
— If you still have a valid ticket.
— And if I lose it?
— We start with “Good morning, who are you?”
— Just like a government office!
— Except our queue has better chairs.
The hotel that asks permission for everything
An enormous sign appeared in the lobby: “ACCEPT ALL COOKIES”.
— I only wanted to check breakfast time! — protested a guest.
— You can reject the optional ones — said Greg.
— Where?
— Under “Customize preferences”.
— And beneath that?
— Twelve more switches.
Some cookies are necessary for a service, such as keeping a user signed in or maintaining a shopping basket. Others support analytics, advertising and recognizing visitors over time. Third-party cookies can help track people across websites, although modern browsers increasingly restrict them.
Depending on the law and the purpose, certain cookies require consent; others that are strictly necessary for a requested service may not. Seeing a cookie banner doesn't mean every cookie is dangerous.
— Can I reject the advertising ones?
— Certainly, if they're optional.
— Will I still get breakfast?
— As long as the waiter from next door hasn't eaten your order.
A virus, or a chocolate biscuit?
Greg held a ticket up to the light.
— Is this a program? Can it run by itself?
— No. A cookie is data, not a standalone virus.
— Can it track me?
— It can help identify a browser and track activity, depending on how it's used.
— If I delete cookies, does all my information disappear from the Internet?
— No. You'll throw away the local tickets, but the hotel's guest register won't vanish.
Deleting cookies may sign you out of websites, reset preferences or make a consent banner appear again. It doesn't delete the account, information kept on the server or every record of activity online.
— And what about the cache?
— Different thing. A cloakroom ticket isn't a newspaper copy we keep under the counter.
— Right. Could I at least have a real cookie?
— Not until you've checked in.
The night-shift report
At midnight Greg was closing reception.
— How many guests?
— Four hundred — replied Agnieszka.
— How many do we remember?
— Those we can identify using valid tickets or other information.
— How many asked for cookies?
— All of them.
— What did we give them?
— The terms and conditions. Some are still scrolling.
A cookie is a small identifier or piece of data that helps browsers and servers maintain continuity between requests. It may support convenience, essential site functions or tracking. That's why it's worth knowing what a website stores and making conscious privacy choices.
Management of the Cookie Hotel reports: the ticket system is working as intended. Agnieszka recovered her suitcase, four hundred guests received their rooms, and Greg accidentally cleared every cookie in his browser. Now the hotel keeps asking who he is. So does his wife. A notice has been posted at reception: “DO NOT DELETE TICKETS BEFORE PAYDAY”. 🍪🏨🤣❤️