Which sequence demonstrates how a session cookie is installed?

Which sequence demonstrates how a session cookie is installed?

• A. Client posts credentials; server responds with a Set-Cookie header containing a session ID; browser stores and uses it in subsequent requests
• B. The browser stores credentials in local storage
• C. The server places a session ID in a response header without Set-Cookie
• D. The server never sends cookies for sessions

Answer: (A)

A session cookie is installed when the server acknowledges a login by sending a Set-Cookie header containing a session identifier. After the client posts credentials and the server validates them, it responds with Set-Cookie. The browser stores this cookie (respecting domain, path, expiration, HttpOnly, Secure attributes). Then, in every subsequent request to the same server, the browser automatically includes the cookie in the Cookie header, allowing the server to recognize and maintain the session. Storing credentials in local storage isn’t how cookies are installed or used for sessions, so that wouldn’t establish a session via cookies. Placing a session ID in a response header without Set-Cookie won’t create a cookie in the browser. And if the server never sends cookies, there’s no cookie-based session to rely on.

A session cookie is installed when the server acknowledges a login by sending a Set-Cookie header containing a session identifier. After the client posts credentials and the server validates them, it responds with Set-Cookie. The browser stores this cookie (respecting domain, path, expiration, HttpOnly, Secure attributes). Then, in every subsequent request to the same server, the browser automatically includes the cookie in the Cookie header, allowing the server to recognize and maintain the session.

Storing credentials in local storage isn’t how cookies are installed or used for sessions, so that wouldn’t establish a session via cookies. Placing a session ID in a response header without Set-Cookie won’t create a cookie in the browser. And if the server never sends cookies, there’s no cookie-based session to rely on.