Cookies, sessions, and how a site remembers you
The web has no memory. The small note in your browser is the login. Treat it like a key.
A website has no memory. Each request is a stranger unless the site left a small note on your computer. That note is a cookie. A session is the story the server keeps for that note: logged in, cart full, language set. This is 1990s plumbing. It still runs the modern web.
What the cookie actually holds
Sometimes the cookie is the whole secret, a token the server can verify. Sometimes it is only an ID, and the real data sits in a server table. Either way, anyone who copies the cookie can often wear your login until it expires.
That is why a stolen laptop with an unlocked browser is not “just a laptop.” The session is sitting in the profile. That is why “remember me” on a shared PC is a gift to the next person.
HTTPS keeps a café from reading the cookie on the wire. It does not stop malware on the machine. It does not stop an extension that can read every site. It does not stop you from pasting a cookie into a “debug” form that a stranger built.
Old rules that still work
Log out on machines that are not yours. Use a private window at a library. Do not stay logged into mail in a browser you share with family without a separate profile. When a site offers “log out all other sessions,” that is the kill switch for a cookie you no longer control.
SameSite and HttpOnly flags are the grown up settings. HttpOnly means JavaScript on the page cannot read the cookie. That blocks a class of theft. It does not block everything. You still do not click mystery links while you are logged into a bank.
A practical picture
Clearing cookies logs you out. It does not change your IP. A VPN changes your IP. It does not drop the cookie. Tracking companies like cookies because they persist. You can block some of them. You cannot block a login cookie and still stay logged in. That is the deal, and it has been the deal since Netscape named the thing.