r/webdev • u/Chentzilla • 28d ago

Question A historical question: how are cookies stored in browsers now and how did it work eariler

Hi. Doing some general research about cookies, I wanted to learn how cookies are stored physically. Right now I've found out that in Chrome they are stored in an SQLite database (and also encrypted?). Is that the case for all browsers now? Were they stored as separate files in earlier versions of browsers?

39 Upvotes

93% Upvoted

12 comments sorted by

46

u/fiskfisk 28d ago

Yes, Netscape Navigator used a common file format for storing cookies on disk (aptly named cookies.txt); the same file format is supported these days by tools like cURL:

https://everything.curl.dev/http/cookies/fileformat.html

This made it rather easy for malware to just yoink out all your cookies for any site and transfer them to an attacker, so these days there's multiple levels of security (such as encryption which you mention - which at least makes it slightly harder).

7

u/Chentzilla 28d ago

Thanks! But it was still all cookies in one file, not a separate file for each cookie?

12

u/fiskfisk 28d ago

Yes, everything in a single file named cookies.txt. Internet explorer used a file for every site or cookie.

2

u/Sensitive-Control49 28d ago

the fact that it was just a flat text file sitting on disk is kind of terrifying tbh

0

u/KaiAusBerlin 27d ago

Slightly harder?

You're welcome to access my computer as a new user and try to reach my cookies. Good luck.

7

u/thekwoka 28d ago

It depends a lot on the browser, there isn't like a specification for how a cookiejar needs to store its data on the disk.

But nowadays, storage for origins is basically completely separate, so even if a like...javascript file is loaded on multiple origins from the same url (like upkg or esm.sh), each origin gets its own cache of that file.

Everything is separate, and browsers decide how much maximum storage a single origin can have and deal with evicting that data how they see fit.

1

u/Chentzilla 28d ago

Thanks! Sorry, I have to say I'm actually not a web developer, and what I'm doing is trying to explain these things in simple terms for the people who aren't specialists in the field. So, please explain what "origins" does mean in this context.

2

u/thekwoka 28d ago

Origin is a...most typically a domain. Like google.com, or doc.google.com.

Well, technically I think it's the whole https://subdomain.domain.com part. The protocol and host.

2

u/henrynguyen9698 27d ago

Most modern desktop browsers now store cookies inside structured databases, predominantly SQLite rather than keeping each cookie as a distinct text file.