• On the diagram of a cookie session, the last arrow says bye + ex-cookies. Does this mean that the response to the logout form still includes the cookies, they're just not used anymore?

    What a great question! Someone was reading very carefully!

    What I intended (given very little space) was that the response would *expire* the cookies. Possibly also replacing them with an empty value.

    So, yes, the browser should no longer use those expired cookies, and will probably remove them from the cookie jar.

  • I was trying to click on the link: https://www.seotakeaways.com/google-analytics-cookies-ultimate-guide/ however, I got a 404 error and I was wondering if this is a good guide to look at: https://analytify.io/google-analytics-cookies/

    Ah, bummer. I'm sorry that my link has disappeared.

    Yes, that looks good. Even has the same title. Thanks for finding it!

  • How do we prevent from someone altering a cookie (in a malicious way)?

    One option is to digitally sign it so that you can detect alteration. If it's altered, you can then discard the cookie.

    Like those "tamper-evident" seals on jars and such.

  • What happens when a cookie expires while a user is still using a website, can we prevent that?

    What might happen is that the user is forced to login again. A common scenario is a banking app, where if you take a break for 10 minutes and come back, you have to login again.

    I have to do that with Brightspace and lots of other apps at Wellesley.

    I agree that this is annoying, but on balance it's probably a good thing.

    But there's also the trick that every interaction resets the expiration time to N minutes in the future, so that as long as the user continues to interact, the cookie doesn't expire.

  • What happens if we try to write more data to the cookie than the limit?

    Great question! Let's try an experiment! I just tried to set a *huge* cookie using our movie-listings example, and I got an error in Flask: 

                /home/cs304flask/public_html/downloads/venv-fa26/lib64/python3.12/site-packages/werkzeug/sansio/response.py:232: UserWarning: The 'user-decade' cookie is too large: the value was 16064 bytes but the header required 59 extra bytes. The final size was 16123 bytes but the limit is 4093 bytes. Browsers may silently ignore cookies larger than this.
  dump_cookie(

    And the cookie wasn't sent.