Remember me next time: sessions and cookies

Forgetful means the login keeps dropping

Earlier we learned HTTP is forgetful.
When a request ends, it forgets us clean.
So when we ask again next time,
it treats us like a first-time guest.
That raises one strange point.
We logged in only once,
so why do we stay logged in for a long while?
If it forgets every time,
we ought to log in again on every visit.

Press the visit button. The forgetful server forgets each time, so the login drops on every visit and you must log in again.

As you saw, it is far too inconvenient.
Logging in on every visit
would wear us out fast.
Yet we cannot ask the server
to memorize every single guest.
There are simply too many guests.
So we use one clever trick.
Instead of the server memorizing,
it hands the guest a small ticket.

The server hands out a small pass

On the first visit
the server gives the guest a small ticket.
We call this ticket a cookie.
The ticket has one number written on it.
Something like "you are guest number 7."
Think of the wristband
or entry stamp you get at an amusement park.
If the server keeps just that number,
it need not memorize each of the many guests.

Press the issue button. The server hands the guest a small pass (cookie) with a number on it.

Now in the guest's hand
there is a pass with a number on it.
The server writes that number down,
linked to this guest.
The key point is
that the guest carries the pass around.
The server does not memorize it all;
the guest keeps their own number.
So when should this pass
be pulled out and shown again?

Show the pass on every visit

The guest who got the pass
just tucks it into a pocket.
Then, next time they ask the server,
they show that pass along with the request.
Saying, "I am guest number 7."
They hold it out every single visit.
It is like writing the number
on a corner of the request slip.
So just by reading the request, the server
can tell at once who sent it.

Press the visit button. The guest holds out the pass number along with the request, every time.

Now whenever the guest asks,
they send the same number along.
From the server's side,
the number lands in hand each time.
Being forgetful, it cannot memorize the guest,
but since the number rides with the request, it is fine.
So what does the server
do when it sees that number?
It can match it against
the list it wrote down, right?

Ah, that person! It recognizes you

When the pass number arrives,
the server opens the list it kept.
"Who is number 7 again," it searches.
When it finds 7 on the list,
it recognizes you: "Ah, that person!"
Keeping this thread that you are the same guest
across visits
is exactly the session.
Thanks to it, the login does not drop
and carries straight on.

Tap the arrived pass number. The server finds it on the list, recognizes "Ah, that person!", and keeps the login going.

It was a forgetful server,
yet now it recognizes us with ease.
The trick is not that the server memorized,
but that the guest carried the pass.
The server only matches number to list,
so it handles many guests with no sweat.
But there is one thing
we must be careful about.
If anyone with the right number gets through,
what if someone picks up another's pass?

Let's wrap up

Gathered on one line, it is this.
HTTP is forgetful, treating us as a first-time guest each time.
The server issues one small pass, a cookie.
The guest shows that pass on every visit.
The server reads the number and goes, "Ah, that person!"
Keeping the thread that it is the same guest is the session.
Thanks to it, you do not have to log in again every time.
The remembering is left to the guest's pass,
and the server only matches the number.

Tap the key points in order to review. (forgetful is the problem → issue a pass (cookie) → show it every visit → ah, that person! (session))

Now you know how the server
recognizes us again.
But if only the pass number matches,
whether that is truly you
has not yet been checked.
Is the one holding the number
really that person?
What if someone intercepts it?
Let's follow that story of checking trust
together in the next area.