Cookies, Sessions and Storage

A customer checks their bank balance on a library computer, clicks Log out and walks away. The next person opens the same browser, presses Back, then Reload… and lands in the first customer’s account.

The logout button “worked”: it showed the login page. But the login token was still sitting in the browser’s storage, and the app happily used it again. Nobody noticed in testing, because nobody looked at what the browser was remembering.

That’s what this lesson is about. Websites keep a surprising amount of data in your browser: cookiesCookieA small piece of data a website stores in your browser, for example to keep you logged in.Open in glossary →, local storageLocal storageBrowser storage where websites keep data that survives closing the tab, like settings or a cart.Open in glossary →, session storage and more. Testers who know where to look find bugs in privacy, security and “it forgot my cart” problems that everyone else misses.

Why it matters

• Security: a session that doesn’t end on logout, or a token readable by any script, can hand someone else your account.
• Privacy and law: in the EU and UK, tracking cookies need consent. A “Reject” button that doesn’t actually reject is a legal risk, not just a bug.
• Money: a cart that disappears after login, or a checkout that logs you out halfway, loses sales.
• Trust: seeing someone else’s cart or name on a shared computer is the kind of bug that ends up in the news.

Where a website keeps data

Storage	Lifetime	Sent to the server automatically?	Readable by page JavaScript?	Typical use
Cookie	Until it expires, or until the browser closes (session cookie)	Yes, with every request to its domain	Yes, unless HttpOnly	Login session, consent choice, language, analytics IDs
localStorage	Forever, until the site or user deletes it	No	Yes	Guest cart, theme, “don’t show again” flags
sessionStorage	Until the tab is closed (survives reloads)	No	Yes	Form drafts, one-time banners, checkout steps in one tab
IndexedDB	Forever, until deleted	No	Yes	Large structured data: offline mode, cached messages, files
Cache Storage / HTTP cache	Until evicted or cleared	(It replaces requests)	Cache Storage: yes	Offline pages (service workers), images, scripts

The sizes differ too: a cookie holds about 4 KB, localStorage and sessionStorage about 5 MB per site, and IndexedDB can hold far more. You don’t need to memorize numbers, but you should know which one a feature uses, because that decides what survives a reload, a closed tab or a logout.

Cookies up close

A server creates a cookie by sending a Set-Cookie header in its response. The browser stores it and sends it back in a Cookie header with every following request to that site.

Attribute	What it does	What to check
Name / Value	The data, e.g. session_id=s_9f2c…	No readable personal data (email, name) or secrets in plain text
Domain	Which hosts receive it. Domain=shop.example also includes subdomains like api.shop.example; without a Domain, only the exact host gets it	Not wider than needed
Path	Which URLs receive it, usually /	Admin cookies limited to admin paths if intended
Expires / Max-Age	When it’s deleted. No expiry = session cookie	Matches the requirement (“Remember me” for 30 days, otherwise session)
HttpOnly	Page JavaScript can’t read it (document.cookie won’t show it)	Must be set on session/auth cookies, so Cross-site scripting (XSS)Cross-site scripting (XSS)An attack where text a user enters is run as code in other people's browsers.Open in glossary → can’t steal them
Secure	Only sent over HTTPSHTTPSThe secure version of HTTP; traffic between the browser or app and the server is encrypted.Open in glossary →	Must be set on anything sensitive
SameSite	Whether it’s sent on requests coming from other sites: Strict, Lax or None	Lax or Strict for sessions. None requires Secure. If SameSite is missing, Chromium browsers (Chrome, Edge) treat the cookie as Lax

Session cookies vs persistent cookies

• A session cookie has no Expires or Max-Age. The browser deletes it when it closes. In DevTools its expiry shows as Session.
• A persistent cookie has an expiry date and survives restarts. “Remember me”, language and consent cookies are usually persistent. Chrome caps cookie lifetimes at 400 days.

First-party vs third-party cookies

• First-party: set by the site in the address bar (shop.example). Login, cart and consent cookies.
• Third-party: set by another domain embedded in the page, e.g. an ad network’s IDE cookie from adnet.example. Used mostly for tracking across sites.

Browsers increasingly restrict third-party cookies. Safari blocks them by default, Firefox isolates them per site, and Chrome blocks them in Incognito windows and lets users block them everywhere. For testers this means: features that rely on third-party cookies (embedded logins, chat widgets, payment iframes) must be tested in Safari, Firefox and Incognito, or they’ll break for real users. See Cross-browser Testing.

Sessions: how “staying logged in” works

HTTP itself has no memory. Every request is a stranger. A sessionSessionThe period during which a user stays logged in without entering their credentials again.Open in glossary → is how the server recognizes you again:

Some apps use a token (often a JWT) stored in localStorage instead of a cookie and send it in an Authorization header. That works, but any script on the page, including an injected one, can read localStorage. So check extra carefully that the token is removed on logout and expires on its own.

“Remember me” usually means a persistent cookie with a long expiry (for example 30 days) instead of a session cookie. When it’s unchecked, closing the browser should log you out.

localStorage, sessionStorage, IndexedDB and cache

Event	Cookies (session)	Cookies (persistent)	localStorage	sessionStorage
Reload the page	Kept	Kept	Kept	Kept
Open the site in a new tab	Shared	Shared	Shared	New, empty
Close and reopen the tab	Kept	Kept	Kept	Gone
Quit and reopen the browser	Gone	Kept until expiry	Kept	Gone
Private / Incognito window	Separate, wiped on close	Separate, wiped on close	Separate, wiped on close	Separate
DevTools › Clear site data	Gone	Gone	Gone	Gone
User clicks Log out	Only what the app deletes	Only what the app deletes	Only what the app deletes	Only what the app deletes

(Reopening a closed tab with Ctrl/Cmd+Shift+T, or duplicating a tab, can bring sessionStorage back, so close tabs normally when you test this.)

The last row is the important one. Logout clears nothing automatically. The app must delete every piece of personal data itself. That’s where the bugs are.

IndexedDB is a real database inside the browser, used by apps that work offline (email, notes, chat). Test it like localStorage: is it cleared on logout? Does it hold sensitive data? Cache Storage (used by service workers) can serve an old version of a page after a release, a classic “the fix doesn’t show up” problem. Clear site data removes all of these at once.

Consent banners: GDPR basics for testers

In the EU, the ePrivacy rules require consent before storing non-essential cookies (analytics, advertising, social media), and the GDPR defines what valid consent is. The UK has similar rules (PECR), and since 2026 allows some simple first-party analytics cookies without consent as long as users can opt out, so check which rules your product follows. You don’t need to be a lawyer, but you should test these points:

• Nothing optional before a choice. Before you click anything, only strictly necessary cookies may exist (session, cart, security, the consent choice itself). No _ga, no ad cookies, no requests to analytics domains.
• Reject is as easy as Accept. A “Reject all” button on the first layer, equally visible. Not hidden behind “Settings” in grey text.
• Reject really rejects. After rejecting, no analytics cookies appear, and no analytics requests show up in the Network panel, on this page or the next ones.
• Accept really accepts. The expected cookies appear, and only after the click.
• The choice is remembered (usually in a consent cookie), and the banner doesn’t reappear on every page.
• Consent can be withdrawn as easily as it was given (a “Cookie settings” link), and withdrawing deletes the cookies or at least stops new tracking.
• Granular choices work. If there are toggles per category, each one is respected.

Try it: a shop and its Application panel

Pantry is a small shop with DevTools’ Application panel next to it. Everything you do writes to cookies, localStorage or sessionStorage, and changed rows flash yellow. Use the browser controls to close the tab, quit the browser or let time pass.

pantry.example

Free delivery on orders over €40

Pantry

Guest 0

Log in

Emailanna@test.comben@test.comPassword

Test accounts, password pre-filled.

Remember meLog in

• Olive oil, 750 ml€8.90Add
• Coffee beans, 1 kg€11.50Add
• Fusilli pasta, 500 g€1.80Add

Your cart

Empty

We value your privacy

We use necessary cookies to run the shop. With your OK we also use analytics and advertising cookies.

Reject allAccept all

DevTools›Application

https://pantry.example Clear site data

No cookies for this site.

Select a row to see its full value.

Browser controls

Tue 13 Oct, 09:00

Reload Close & reopen tab Quit & reopen browser Wait 31 min Wait 31 days Restart demo

• → Page loaded. No cookies yet: the consent banner is waiting for your choice.

How to inspect and edit storage in real DevTools

New to DevTools? Start with DevTools for Testers.

Chrome / EdgeFirefoxSafari

1. Open DevTools (F12 / Cmd+Option+I) and go to the Application panel.
2. In the sidebar under Storage, expand Cookies, Local storage or Session storage and click the site’s origin.
3. Read the table: name, value, domain, path, Expires / Max-Age, size, HttpOnly, Secure, SameSite. Cookies with problems are highlighted, and hovering shows why.
4. Edit a value by double-clicking it. Delete a row by selecting it and pressing Delete, or use the 🚫 button to clear the whole list.
5. Clear everything: Application › Storage › Clear site data.
6. To see which cookies a request sent or received, open the request in Network and check its Cookies tab. Blocked cookies are shown with the reason.

1. Open DevTools (F12) and go to the Storage panel.
2. Expand Cookies, Local Storage, Session Storage, Indexed DB or Cache Storage and pick the site.
3. Double-click a value to edit it. Right-click a row to delete it, or delete everything for the site.
4. The sidebar on the right parses values, which is handy for JSON in localStorage.

1. Enable developer features (Safari › Settings › Advanced › Show features for web developers) and open Web Inspector with Cmd+Option+I.
2. Open the Storage tab and choose Cookies, Local Storage, Session Storage or IndexedDB.
3. Double-click values to edit, and use the delete key or the trash button to remove entries.
4. Remember that Safari blocks third-party cookies and limits some script-written storage, so features can behave differently than in Chrome.

The Console is useful too:

• document.cookie lists the cookies JavaScript can read. If you see the session cookie here, it’s missing HttpOnly. That’s a bug.
• localStorage.getItem('cart') shows one value. Object.keys(localStorage) lists every key.
• localStorage.clear() and sessionStorage.clear() wipe them for this site.

What to test

Login and logout

• Logging in sets a session cookie with HttpOnly, Secure and SameSite. Nothing secret appears in localStorage or the URL.
• Logging out deletes the session cookie and any tokens or personal data in localStorage, sessionStorage and IndexedDB.
• After logout, Back and Reload don’t show account pages. A copied old session cookie no longer works.

Session expiry and “Remember me”

• After the idle timeout, the next action asks you to log in again, with a clear message and without losing what you typed if possible.
• “Remember me” off: quitting the browser logs you out (session cookie). “Remember me” on: you stay logged in until the stated expiry, then you’re logged out.
• The session also expires on the server: deleting or editing the cookie mid-session leads to a clean “Please log in” state, not a crash or a blank page.

Multiple tabs and windows

• Logging out in one tab logs you out in others on their next action.
• Logging in as another user in a second tab doesn’t mix data between the two.
• A private / Incognito window starts clean and keeps nothing after closing.

Cart and preferences

• The guest cart survives a reload and a browser restart (if the requirement says so).
• Logging in merges or replaces the guest cart as specified. Logging out doesn’t leave the cart for the next person on the same browser.
• Language, theme and “don’t show again” choices persist where expected, and nowhere else.

Consent and privacy

• No optional cookies or analytics requests before consent. Reject works. Accept works. Withdrawing works.
• No personal or sensitive data in localStorage (email, address, tokens, card details).
• Clearing cookies mid-session, or blocking cookies entirely in browser settings, produces a helpful message, not a broken site.

Common bugs

#	Bug	What you see	Typical severity
1	Logout doesn’t clear the token	Token stays in localStorage; Reload or Back logs you back in	Critical
2	Session never expires	Still logged in after hours of inactivity; server accepts old tokens	High
3	Session cookie missing HttpOnly / Secure	document.cookie shows the session ID; no ✓ in the HttpOnly/Secure columns	High
4	“Remember me” ignored	Cookie has an expiry date even when unchecked, or none when checked	Medium–High
5	Reject doesn’t reject	Analytics cookies and requests appear after “Reject all”	High (legal)
6	Cookies set before consent	_ga or ad cookies exist before you click the banner	High (legal)
7	Data leaks between users	Previous user’s cart, name or address shown after logout/login on the same browser	High–Critical
8	Sensitive data in web storage	Email, address, tokens or card data in localStorage	High
9	Crash when a cookie is missing	Deleting a cookie gives a blank page or endless spinner instead of “Please log in”	Medium
10	Cart lost on login	Guest cart disappears when the user logs in	Medium

Find the bug

Here’s another build of Pantry, with six bugs. Watch the Application panel closely after every action, and use the browser controls.

• Make a cookie choice, then look at the Cookies table.
• Log in (with and without “Remember me”), then log out and reload.
• Check the flags on session_id.
• Quit the browser, wait, and log in as a different user.

🐞 Bug hunt: Pantry shop storage

This demo has 6 hidden bugs. Explore it like a tester, then check your findings.

Found0/6

pantry.example

Free delivery on orders over €40

Pantry

Guest 0

Log in

Emailanna@test.comben@test.comPassword

Test accounts, password pre-filled.

Remember meLog in

• Olive oil, 750 ml€8.90Add
• Coffee beans, 1 kg€11.50Add
• Fusilli pasta, 500 g€1.80Add

Your cart

Empty

We value your privacy

We use necessary cookies to run the shop. With your OK we also use analytics and advertising cookies.

Reject allAccept all

DevTools›Application

https://pantry.example Clear site data

No cookies for this site.

Select a row to see its full value.

Browser controls

Tue 13 Oct, 09:00

Reload Close & reopen tab Quit & reopen browser Wait 31 min Wait 31 days Restart demo

• → Page loaded. No cookies yet: the consent banner is waiting for your choice.

1. 1

   Hint: Click Reject all and look at the Cookies table.

   "Reject all" still sets analytics cookies

   After Reject all, the _ga and _ga_K7Q2PL analytics cookies are set anyway, next to cookie_consent=…analytics:0. Expected: only strictly necessary cookies and the consent choice. Besides being a bug, this breaks EU/UK consent rules.

   Reveal answer✓ I found this
2. 2

   Hint: Log in, log out, check Local storage, then press Reload.

   Logout leaves auth_token in localStorage and a reload logs you back in

   Logout deletes session_id, but auth_token stays in localStorage. On reload the app uses it to create a new session silently, so "logged out" users on a shared computer are logged straight back in. Expected: logout removes every token and the next page load shows a guest.

   Reveal answer✓ I found this
3. 3

   Hint: Log in and select session_id in the Cookies table.

   Session cookie has no HttpOnly or Secure flag

   session_id has HttpOnly: no, Secure: no and no SameSite. Any script on the page (for example injected via XSS) can read it with document.cookie, and it can be sent over plain HTTP. Expected: HttpOnly; Secure; SameSite=Lax (or Strict).

   Reveal answer✓ I found this
4. 4

   Hint: Log in with Remember me unchecked, look at the Expires column, then Quit & reopen browser.

   "Remember me" is ignored: you stay logged in after quitting the browser

   Even with Remember me unchecked, session_id gets an expiry date 30 days ahead instead of Session, so it survives a browser restart. Expected: a session cookie when unchecked, a 30-day cookie only when checked.

   Reveal answer✓ I found this
5. 5

   Hint: Log in as Anna, add items, log out, then log in as Ben.

   Ben sees Anna's cart after she logs out

   The cart is stored in localStorage under one shared cart key and is not cleared on logout or reloaded per user. After Anna logs out and Ben logs in on the same browser, Ben sees (and could buy) Anna's items. Expected: logout clears the cart, and each user gets their own cart from the server.

   Reveal answer✓ I found this
6. 6

   Hint: Log in without Remember me, delete auth_token, then use Wait 31 min.

   The session never expires

   After 31 minutes of inactivity you are still logged in, and the session_id value hasn't changed, so the server accepted the old session. Expected: after the 30-minute idle timeout the next request returns 401 and the page says "Your session expired. Please log in again."

   Reveal answer✓ I found this

More security checks like these are in Security Basics for Testers, and the full login flow is covered in Login and Sign Up.

Example test cases

Checklist

Cookies, sessions and storage checklist

0 of 15 checked

Copy

• Session cookie has HttpOnly, Secure and SameSite (Lax or Strict)
• No tokens, passwords or personal data in localStorage, sessionStorage or URLs
• Logout deletes the session on the server and all auth data in the browser
• Back and Reload after logout do not show account pages
• Idle timeout and absolute timeout work, with a clear "session expired" message
• "Remember me" off: session cookie; on: persistent cookie with the documented expiry
• Multiple tabs: logout in one tab is respected in the others
• Private window starts clean and keeps nothing after closing
• Deleting or editing cookies mid-session leads to a clean logged-out state
• Guest cart persists as specified and merges or resets correctly on login
• No cart or personal data carries over to the next user on the same browser
• No optional cookies or tracking requests before consent
• Reject all is as easy as Accept all, and really rejects
• Consent choice is remembered and can be changed later
• Features relying on third-party cookies tested in Safari, Firefox and Incognito

Check your understanding

Quick quiz

0/5 answered · 0 correct

1. 1.In DevTools, a cookie shows "Session" in the Expires / Max-Age column. What does that mean?

   AIt expires in exactly 30 minutesBIt is deleted when the browser is closedCIt is a server-side session recordDIt never expires

2. 2.Which flag stops page JavaScript, including injected scripts, from reading a cookie?

   ASecureBSameSite=StrictCHttpOnlyDPath=/

3. 3.A user dismisses a banner, the site saves that in sessionStorage. When will the banner come back?

   AOn the next reloadBWhen the tab is closed and the site is opened againCNeverDAfter 30 days

4. 4.After clicking "Reject all" on the consent banner, you see a _ga cookie in the Application panel. What is this?

   AExpected: _ga is a necessary cookieBA bug and a likely consent-law violationCA browser extension issueDOnly a problem in Safari

5. 5.You log out, then reload, and you are logged in again. Where should you look first?

   AThe CSS in ElementsBLocal storage and cookies in the Application panelCThe Lighthouse scoreDThe device toolbar

Key takeaways

• Cookies travel to the server with every request. localStorage and sessionStorage stay in the browser. sessionStorage dies with the tab.
• Session cookies have no expiry and vanish when the browser closes. Persistent cookies live until their date.
• Auth cookies need HttpOnly, Secure and SameSite. Tokens and personal data don’t belong in localStorage.
• Logout clears nothing by itself. The app must end the server session and delete every token and personal item in the browser.
• Test expiry, “Remember me”, multiple tabs, private windows, deleting cookies mid-session and switching users on one browser.
• Consent banners: nothing optional before a choice, Reject as easy as Accept, and Reject must really reject. Verify it in the Application and Network panels.