How a cookie works
HTTP is stateless, so each request starts without built-in memory of earlier requests. A server normally creates a cookie with the Set-Cookie response header. The browser stores it and returns it in the Cookie request header when the domain, path, security and SameSite rules match.
HTTP/1.1 200 OK
Set-Cookie: session_id=a1b2c3; Path=/; Secure; HttpOnly; SameSite=Lax
GET /account HTTP/1.1
Host: example.com
Cookie: session_id=a1b2c3The value may hold a preference or, more commonly for logins, an opaque session ID that points to server-side data. Cookies are part of the request’s HTTP headers; they aren’t programs and can’t execute code by themselves.
Common cookie types
| Type | Defined by | Typical use |
|---|---|---|
| Session | No fixed expiry | Login or cart state |
| Persistent | Expires or Max-Age |
Remembered settings |
| First-party | The site you’re visiting | Site functions and analytics |
| Third-party | Another site in the page | Cross-site services or tracking |
Session and persistent describe lifetime. First-party and third-party describe context, so a cookie can be both persistent and first-party.
Cookies and proxies
A proxy changes the IP address a website sees, but it doesn’t automatically clear or replace cookies. Reusing one cookie jar across rotating IPs lets the site connect those requests to the same session. For a logged-in sequence, pairing the cookie jar with a sticky session usually produces more consistent state than changing IPs between steps.
Sites may evaluate cookies together with request rate, IP history and browser fingerprinting. Clearing cookies doesn’t remove those other signals, and changing IPs doesn’t create a fully separate browser identity.
Handling cookies safely
- Separate sessions. Give each user, account or independent job its own cookie jar.
- Protect authentication cookies. Don’t log, publish or share session values because they may grant account access.
- Keep related requests together. Preserve the required cookies through carts, logins and multi-page workflows.
- Respect site limits. Don’t reset cookies to bypass access controls, rate limits or terms of service.
FAQ
Does changing my proxy clear cookies?
No. Cookies remain in your browser or HTTP client’s cookie jar until they expire or you remove them. A new proxy IP can still send the same cookie values.
Should a web scraper keep cookies?
It depends on the workflow. Keep cookies for related pages that need shared state, but use separate jars for independent jobs and don’t reuse authenticated cookies across accounts.
Are cookies the same as a browser fingerprint?
No. A cookie is stored data that the client sends back to a site. A browser fingerprint is inferred from characteristics such as screen settings, fonts and browser behavior, so it may persist after cookies are deleted.