Now, those in this late, we are going to understand all the concepts related to cookies.
So first of all, we are going to Nestande Assassin tracking using cookies so as to deprive the stateless
clan.
So a protocol where a client makes a request and the server responds with the data and the next request
that comes in an entirely new request and unrelated to the previous request.
So the design of a suitable request is so that they are all independent of each other.
You when you when you add an item in your shopping cart while doing only stopping the application needs
a mechanism to tie the item to your account.
Each application may also different ways to identify each session.
So the most widely used mechanism to transition is to a session idy set by the server as soon as user
authenticates with a valid username and password.
A unique random random we can see Sition ID is assigned to the user on every question where the client.
It should include the unique session that would tie the request to the authenticated user and the idea
could be shared using the method or the post method.
When using the Gatemouth, our decision idea would become a part of the order when using the post matter,
the idea see it in the body of data, the method that we have seen in the last lecture, and the server
who maintain a table mapping usernames to the assigns us an idea.
The biggest advantage of assigning a session add is that even though a startup is stateless, the user
is not required to indicate every request.
The browser would present decision it and the server would accept it simply so.
Security has a drawback to.
So anyone who gains access to the station ID could simply impersonate the user without requiring a username
and password.
So also the Trenton decision depends on a degree of randomness used to generate it, which would help
to defeat the brute force attack.
So now let's now understand what is a cookie.
So cookies are actual mechanism using was the it is passed back and forth between the user of the client
and the Web server when using cookie dough.
So assigns a client a unique idea by setting the set cookie feel.
That is why I have thought you said cookie parameter.
So in the ISP request.
So when the client receives the header it will stow's the value of the cookies that this decision idy
within the browser and associated with the website.
You are told to send it.
When a user is simply revisit the original website, the browser will simply send the cookies values
across identifying user.
So besides saving the critical authentication information, Cookie can also be used to set preference
information for the end client such as language.
So the cookie is touring the language.
Preference for the user is then used by the server to display the webpage in the user preferred language
when the user came back.
So then we are having her now.
First of all, let's see how the cookies flow between the server and the client works.
So now as we are having this particular picture, the screen source, the cookies always sit and control
by the server and the web process only responsible for sending it across to SOA, but every request.
So in this particular screenshot, we can see that a get request is made to the server and the application
on the server chooses to set some cookies to identify the user.
And the language selected by the user is previously requested.
So in subsequent requests made by the client and the set cookie becomes the part of the request.
OK, so now let's now understand what is persistent and non persistent cookies.
So here you can see we are having Trilling's.
So let's understand what is persistent and non persistent.
So cookies are divided into two categories.
Persistent cookies.
Are that simply whose doors on the hard drive as a text file says the cookies are stored on the hard
drive it would.
So why progress?
A cookie, as mentioned previously, can be used to pass this to authentication or authorization actually,
or information in the form of stationery.
So if it is stored on a hard drive, you cannot protect it from the modification by a malicious user
attacker.
You can find the cookie stored on the hard drive when using Internet Explorer and as you can see in
this particular location.
Okay, so this is a location where you can find the cookies, which is is total.
Into your heart.
So this is how you can see persistent and nonparticipants, nothing worked.
Well, it is it is not stored on the hard drive.
OK, so now let's understand the cookies parameter.
So as you can see, in addition to name and the value of the cookie, there's several other parameters
set by the browser or web server that defines the reach and availability of the cookies, as you can
see in this particular screenshot.
So here we are having some parameters.
Let's first understand the doing.
OK, so here we are having set cookie inside this.
We are having OK, let me you into color here.
We are having this particular cookie barometer set barometer inside this we have been doing.
OK, so they simply specify the domain to which cookies would be sent.
So then we're having Pat.
So this is the path before the logged on the cookie, the perimeter can be specified if the domain specified
this e-mail dot com and the part is set to the meal and the cookies would only be sent to the beach
inside a.m. dot com mail, which you can see here, e-mail, dot com mail.
OK, so then we are having to be only which is here.
So this is a barometer that is set to mitigate the risk posed by the cross that is crippling attack
us and JavaScript won't be able to access the cookie.
So then as you can see, it should be only expired.
OK, so here we are having expires also.
So this cookie will be stored until the time specified in this parameter.
So this is how secure cookies and persistent, non processed and cookies perimeter's all looks together.
So this is all for this lecture.