# Cookies, Sessions and State

> How a stateless protocol remembers you: cookie attributes, protective flags, server-side sessions, tokens, and a full review of a sign in flow.

Canonical: https://codelivly.com/rooms/cookies-sessions-and-state
Last updated: 2026-11-15

| | |
|---|---|
| Level | Beginner |
| Category | Web |
| Lessons | 6 |
| Estimated time | 3 h 30 min |
| XP | 150 |

HTTP forgets every visitor after each request, so sites use cookies to carry a small reminder. This room takes the Fernhill shop cookies apart attribute by attribute: Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite, and what each one stops. You read a server-side session store, decode a signed token to see what anyone can read in it, and compare the two designs. The room ends with a guided review of the cookies set during sign in at accounts.fernhill.lab.

## Lessons

1. Why HTTP Needs Cookies: State on a Stateless Protocol (30 min)
2. Set-Cookie Attributes: Domain, Path, Expires and Max-Age (30 min)
3. Secure, HttpOnly and SameSite: The Protective Flags (35 min)
4. Server-Side Sessions: IDs, Storage and Expiry (35 min)
5. Tokens Versus Sessions: Where State Lives (35 min)
6. Guided Lab: Review the Cookies of a Login Flow (45 min)

## Related

- [Learning path: Web Fundamentals](https://codelivly.com/learning-paths/web-fundamentals)
- [All rooms](https://codelivly.com/rooms)