Cookies are not magic. They are just simple text files. Specifically, they are name-value pairs sitting on your hard drive. A website puts them there. The website gets them back later. That is the entire lifecycle. A site can only read the cookies it wrote. It cannot sniff other files. It cannot look at anything else on your machine.
Here is the technical reality of how that data moves.
The Request Cycle
You type a URL into your browser. Say it is http://www.amazon.com. Your browser sends a request to Amazon’s server for the home page. This is standard web traffic.
But before or during that request, your browser checks your local storage. It looks for a cookie file that Amazon previously set.
If it finds that file, your browser grabs all the name-value pairs inside it. It sends those pairs to Amazon’s server along with the URL request. If it finds no file, it sends nothing. Zero data. No cookies.
Server-Side Logic
Amazon’s web server receives the request. It also receives the cookie data, if any exists.
If name-value pairs arrive, Amazon uses them. Maybe to keep you logged in. Maybe to remember your shopping cart.
If no pairs arrive, Amazon knows you are new. You have not visited before. The server creates a new ID in its database. It then sends back a header containing new name-value pairs. Your machine receives that header and stores the pairs on your hard disk. You now have a cookie.
The server can update those values. It can change them. It can add new pairs every time you visit and request a page.
Expiration and Path
The server sends more than just the data. It includes metadata.
One key piece is an expiration date. This tells your browser when to delete the cookie.
Another is a path. This restricts which parts of the site can access the cookie. A site can associate different cookie values with different directories. /shop might have different data than /blog.
User Control
You have control over this process. It is not automatic.
You can set an option in your browser. When a site tries to send name-value pairs, your browser interrupts. It informs you.
You then decide. Accept or deny. You can block cookies entirely. Or allow them selectively. This is your leverage. The server sends the offer. You make the call.
Most people never change the settings. They accept everything. Is that smart? Maybe not. But the option exists.
