Session cookies are temporary cookies that websites use during your current browser session. Cookies are small pieces of data stored in your browser that can contain a session ID, a language preference, or other information associated with a user. When you visit a website, your browser stores these cookies and includes them in subsequent requests that match their scope. The website can then use that information to recognize your login status, retrieve an ongoing transaction, or remember your preferences. Session cookies are intended for temporary use, while persistent cookies can remain available for future visits.
Session cookies are temporary cookies created without an expiration date or a maximum lifetime. The browser normally removes them when its session ends, but session restore features can bring them back when the browser reopens. Leaving a website or closing a single tab does not necessarily delete them.
The term “session cookie” describes the cookie’s lifetime, not the information it contains. It may store a temporary preference or an ID linked to information on the server. A cookie containing a session ID can also be persistent if it is configured to remain available across visits.
Technically, session cookies have neither an Expires attribute nor a Max-Age attribute. These attributes and the effect of session restoration are explained in MDN’s Set-Cookie documentation.
When a website sets a session cookie, your browser stores it and sends it with later requests that match the cookie’s domain, path, and security restrictions. If the cookie contains a session ID, the server uses that ID to retrieve information associated with your visit, such as your login status or shopping cart.
For a cookie that carries a session ID, the process works like this:
The server creates a session record and assigns it a unique ID.
It sends that ID to the browser through a Set-Cookie response header.
The browser stores the cookie and includes it in relevant requests.
The server uses the ID to retrieve session information, such as login status or shopping cart contents.
A session cookie can also store a temporary preference directly, without a separate session record on the server.
The following response header creates an example cookie containing a session ID:
Türkçe
English
Set-Cookie: session_id=example123; Path=/; Secure; HttpOnly; SameSite=Laxexample123 is a placeholder. A real session ID should be random and difficult to guess. Secure requires the cookie to be sent over HTTPS, HttpOnly restricts JavaScript access, and SameSite=Lax limits when it is sent with cross-site requests. Because the header contains neither Expires nor Max-Age, it creates a session cookie. See MDN’s explanation of cookie attributes for further details.
The main difference is how long they are stored. Session cookies are tied to the browser session, while persistent cookies are created with a specified lifetime or expiration date.
Feature | Session cookies | Persistent cookies |
|---|---|---|
Lifetime settings | Have neither | Use one of these attributes to define their lifetime. |
When the browser closes | Are removed when the session ends, although session restoration can preserve them. | Can remain if they have not expired or been deleted. |
Example use | A session ID or temporary preference used during the current visit. | A language or login preference remembered across visits. |
Removal | At the end of the session, or earlier by the user, website, or browser. | On expiration, or earlier by the user, website, or browser. |
Consent requirements | Depend on their purpose and the applicable rules. | Depend on their purpose and the applicable rules. |
A cookie’s lifetime alone does not determine whether it is strictly necessary. Both types can serve different purposes.
A cookie is a small piece of data stored in the browser, while a server-side session keeps information about a user’s interactions on the server. The two often work together: the cookie carries an ID, and the server uses it to retrieve the associated login status, shopping cart, or form data.
The main differences between cookies and server-side sessions are:
Feature | Cookies | Server-side sessions |
|---|---|---|
Storage location | The user’s browser. | The server or a connected data store. |
Function | Store small values and include them in relevant requests. | Keep track of a user’s state and activities. |
Contents | IDs, preferences, or tracking identifiers. | Login status, shopping cart contents, or form data. |
Capacity | Typically around 4 KB per cookie. | Depends on the application and server resources. |
Validity | Determined by the cookie’s lifetime. | Determined by timeouts, logout, or session invalidation. |
Data transmission | The cookie value is included in relevant requests. | Session data remains on the server. |
These two mechanisms can work together. The cookie identifies the relevant record, and the server uses the information stored in it.
Session cookies are used to remember information needed during the current visit. They may contain an ID associated with an ongoing activity or store a temporary preference directly.
Account access: The website recognizes your login status as you move between your profile, orders, and account settings.
Shopping carts: Items you add to your cart remain associated with your visit as you browse product pages.
Multi-step forms: Information entered earlier in an application or registration process is retrieved from the relevant session.
Bookings and checkout: Dates, guest numbers, delivery choices, or order details remain associated with the transaction in progress.
Live chat: You can continue the same conversation when you move to another page.
Temporary preferences: Filters or sorting options are remembered during your visit.
These features can also use persistent cookies or other technologies. To identify the type of cookie in use, check its lifetime attributes.
Session cookies are stored on your device in the browser’s cookie store. They are not necessarily kept only in RAM: browsers may save session cookie data to disk to support session recovery. Their defining feature is their lifetime, rather than their physical storage location.
If a cookie carries an ID for a server-side session, the corresponding session information is stored in the server’s memory or data store. Deleting the browser cookie does not necessarily invalidate the session on the server. A secure logout process should invalidate that session as well.
Not all session cookies require consent. The answer depends on their purpose and the applicable rules, rather than their short lifetime alone. A cookie needed to maintain a shopping cart may qualify for an exemption, while a session cookie used for advertising may require consent.
In the European Union, storing information on a device or accessing information already stored there is governed by ePrivacy rules. GDPR obligations also apply when cookies involve the processing of personal data.
Cookies that are strictly necessary to provide a service explicitly requested by the user may qualify for an exemption from consent under ePrivacy rules. Maintaining a login or shopping cart can fall within this exemption. Cookies used for advertising, profiling, or analytics that fall outside the applicable exemptions require prior consent.
Where consent is required, users must make an active choice after receiving clear information about the purpose. Pre-ticked boxes and continued browsing do not constitute valid consent. Withdrawing consent must be as easy as giving it.
“Session” describes a cookie’s lifetime, while strictly necessary cookies are classified by their purpose. A cookie can operate only during a visit and still be used for advertising or analytics. Necessity therefore depends on the cookie’s role in delivering the service the user requested. If a cookie serves several purposes, each purpose needs to be assessed separately.
In Türkiye, organizations processing personal data through cookies must identify the purpose and the applicable legal basis. Where a legal basis other than explicit consent applies, processing can proceed on that basis. Where explicit consent is required, valid consent must be obtained before processing begins.
Providing a privacy notice and obtaining explicit consent are separate obligations. Users must receive the required information even when consent is not the legal basis for processing. The Turkish Personal Data Protection Authority’s Guidelines on Cookie Practices provide guidance for this assessment.
A cookie policy should explain the names, purposes, lifetimes, and providers of the cookies in use. The technical setup must also respect the choices users make in the preference panel. Cookies that require consent should remain inactive until that consent is given.
To identify session cookies in Chrome, open Developer Tools and check the “Expires / Max-Age” column under “Application → Storage → Cookies.” Entries marked “Session” indicate session cookies. Follow these steps:
Open your website, right-click the page, and select “Inspect.”
Open the “Application” tab.
Go to “Storage → Cookies.”
Select the relevant domain.
Look for entries marked “Session” in the “Expires / Max-Age” column.
“Session” tells you about the cookie’s lifetime. To understand its purpose, check the documentation for the service that sets it. Compare the cookies present before and after actions such as logging in, adding an item to the cart, or giving consent. These fields are explained in Chrome’s cookie inspection documentation.
You can also run an automated scan with Cookie Checker to review detected cookies and tracking technologies. Results depend on the pages scanned and the actions performed. Running another scan after adding a service or plugin makes changes easier to spot.
Okito helps you review detected cookies, manage consent preferences, and maintain consent records in one dashboard. After checking each cookie’s purpose, you can configure the preference panel and block cookies and scripts that require consent until visitors allow them. Visitors can reopen the panel to change their choices or withdraw consent. Regular scans help you review newly added technologies and keep your cookie disclosures up to date.
Deleting session cookies can sign you out, reset your cart, or interrupt a form because the website may lose the identifier linking your browser to that activity. Blocking them can prevent these features from working properly. If you want to remove cookies from a particular site, follow the steps in our guide on how to disable cookies. Clearing cookies removes existing browser data, while blocking limits future cookie use. Use the website’s logout option to end your account session securely.
Session cookies and sessionStorage are different browser storage technologies. Cookies are automatically included in relevant HTTP requests, while sessionStorage data is not sent to the server this way. sessionStorage is also separated by origin and browser tab. That distinction matters when an application needs to keep activities in different tabs separate.
Analytics tools can use session cookies to connect page views and interactions within the same visit. This allows a visitor’s activity to be analyzed as one visit. Whether consent is required depends on the purpose, scope, and applicable rules. A short cookie lifetime does not, by itself, create a consent exemption.
“Browser cookie” is the general term for cookies stored in a browser. A session cookie is one type of browser cookie, intended for temporary use.
Feature | Session cookie | Browser cookie |
|---|---|---|
Scope | A specific type of cookie. | Includes both session and persistent cookies. |
Storage duration | Tied to the browser session. | Depends on the cookie’s type and lifetime settings. |
When the browser closes | Is removed when the session ends, although session restoration can preserve it. | Removal depends on whether it is a session or persistent cookie and the browser’s behavior. |
Example use | A temporary preference stored during a visit. | A temporary preference or a language choice remembered across visits. |
Every session cookie is a browser cookie, but not every browser cookie is removed at the end of a session.
The security of a session cookie depends on how its information is protected. If a cookie represents a logged-in session, stealing it can create a risk of unauthorized account access. HTTPS and appropriate Secure, HttpOnly, and SameSite settings reduce that risk. Server-side session timeouts and invalidation on logout are also important safeguards.
Base your decision on what the cookie does, rather than simply how long it lasts. Blocking a cookie needed for login or shopping cart functionality can interrupt the feature you want to use. Analytics and advertising cookies can be considered separately in the preference panel. Reviewing purpose-based choices gives you more control than blocking every cookie in your browser.
Session cookies are designed to be removed at the end of the browser session rather than on a specified date. Closing one tab may not end the browser session, and session restoration can carry cookies over when the browser reopens. A server-side login session has its own timeout, so you may be asked to sign in again even while the cookie remains in your browser.
Blocking all cookies in Safari can interfere with login and shopping cart features. To remove this block:
Open “Safari → Settings.”
Select the “Advanced” tab.
Deselect “Block all cookies.”
Reload the website and try your action again.
This setting controls the blocking of all cookies, not just session cookies. You do not need to disable “Prevent cross-site tracking” for ordinary first-party session cookies used by the website you are visiting. Menu labels may vary with your Safari version and interface language.