The words, without the shrug

A small value the browser attaches to every request.

How a stateless protocol manages to remember you. The browser stores it and sends it automatically with each request to that site. Marking one HttpOnly prevents JavaScript from reading it, which stops an injected script stealing a session.

See also Session, HttpOnly, JWT