How do cookies work with Set-Cookie and Cookie headers?
PICTURE THIS: A REST CALL
Simple meaning
The server sends Set-Cookie
WHY — HTTP instead of guessing?
Why interviewers care about HTTP:
question about HTTP.
trade-offs, and what you would actually do on a Full Stack project - not buzzwords.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens step by step?
Before you speak the answer, walk the interviewer through these steps:
- 1Define it
The server sends Set-Cookie
- 2the browser stores the
cookie and returns it on later requests to that site via the Cookie header.
- 3Flags such as HttpOnly,
Secure, and SameSite control JavaScript access, HTTPS-only sending, and cross-site behavior.
- 4This is the usual
session mechanism in cookie-based MERN auth.
- 5Common mistake
What juniors usually get wrong.
- 6Close
When you pick this over the alternative.
EXAMPLE — See it in action
Here's a short line you can speak, broken into clear beats:
Note: Adapt this scaffold to your own project — keep it under 60–90 seconds.
Key takeaway
The server sends Set-Cookie the browser stores the cookie and returns it on later requests to that site via the Cookie header.