APIs & Connections
$definecookie--plain-english
TLDRA small note the browser keeps and sends back to that site.
The web forgets you between clicks. A cookie is the small note the browser keeps so the next click is not a stranger.
The server sets it after auth. The browser stores it and attaches it to later requests to that same site. You stay logged in. The cart stays full. The session holds. Without the cookie, every navigation is a new person at the counter.
Two jobs, same mechanism
The cookie that keeps you signed in is first-party. You asked this site to remember you. Treat it like a secret. HttpOnly means JavaScript cannot read it. That is good. A stolen session cookie is a stolen login.
The banners you click through are often third-party notes — other companies recognizing you across sites. Same tiny file. Different intent. A hackathon demo needs the first kind. It does not need a tracking pile.
CORS and cookies fight
Cross-origin requests do not send cookies unless you opted in on both sides. That is why the frontend on another port "loses" the session. Fix CORS and credentials together, or put both rooms behind one origin.
Do not stash API keys in cookies you then log. Do not screenshot the Application tab for Slack. An agent that dumps document.cookie into the transcript just published a login. The builder will pick Better Auth or Clerk so the session cookie is boring and HttpOnly. Let it stay that way.
What this unlocks
The site can remember a judge across refresh.
HTTP has no memory. The cookie is the scrap it leaves in the browser so "who are you?" has an answer.
