# Cookie (/academy/cookie)



The web forgets you between clicks. A **cookie** is the small note the browser keeps so the next click is not a stranger.

The [server](/academy/server) sets it after [auth](/academy/auth). The browser stores it and attaches it to later requests to that same site. You stay logged in. The cart stays full. The [session](/academy/session) holds. Without the cookie, every navigation is a new person at the counter.

**Two jobs, same mechanism**

The cookie that keeps you signed in is first-party. You asked this site to remember you. Treat it like a [secret](/academy/secret). `HttpOnly` means JavaScript cannot read it. That is good. A stolen session cookie is a stolen login.

The banners you click through are often third-party notes — other companies recognizing you across sites. Same tiny file. Different intent. A hackathon demo needs the first kind. It does not need a tracking pile.

**CORS and cookies fight**

Cross-origin requests do not send cookies unless you opted in on both sides. That is why the [frontend](/academy/frontend-backend) on another port "loses" the session. Fix [CORS](/academy/cors) and credentials together, or put both rooms behind one origin.

Do not stash [API](/academy/api) keys in cookies you then log. Do not screenshot the Application tab for Slack. An [agent](/academy/agent) that dumps `document.cookie` into the transcript just published a login. The [builder](/builder) will pick Better Auth or Clerk so the session cookie is boring and `HttpOnly`. Let it stay that way.

**What this unlocks**

The site can remember a judge across refresh.

HTTP has no memory. The cookie is the scrap it leaves in the browser so "who are you?" has an answer.