Cookie
HTTP Cookie
HTTP-Cookie
A cookie is a small file that a website stores in the browser to recognise a user across visits — for instance for logins or settings. Forensically, cookies are revealing because they prove which services were used when. At the same time they are a known target for session theft.
History & facts. Cookies serve to give the otherwise stateless web traffic a memory: login sessions, shopping carts, settings. Especially security-relevant are session cookies that represent a logged-in state — whoever steals them can take over a session, partly even bypassing multi-factor authentication. Forensically, cookies document, together with timestamps, which services a user accessed.
Outlook & recommendation. For the defence, the protection of session cookies counts: secure transmission, suitable protective attributes, short validity and re-authentication for sensitive actions. The theft of valid session tokens is a growing problem because it bypasses login hurdles. In forensics, cookies are a useful activity artefact; as with browser data in general, proportionality and data protection must be observed.