It is often desirable for a Web site to identify user, either because the sever wishes to restrict user access or because is wants to serve content as a function of the user identity. For these purposes, HTTP uses cookies which allow sites to keep track of users. Although not all sites use cookies, most major portals, such as Yahoo, e-commerce, such as Amazon , and advertising, such as DoubleClick, sites make extensive use of cookies. There are four components if cookie technology: (1) a cookie header line in the HTTP response message; (2) a cookie header line in the HTTP request message; (3) a cookie file kept on the user's end system and managed by the user's browser; (4) a back-end database at the Web site.
Cookies can be used to identify a user. The first time a user visits a site, the user can provide user identification. The browser then passes a cookie header to the server during all subsequent visits to the site, thereby identifying the user to the server. Cookies can also create a user session layer on top of stateless HTTP. When a user logs into a Web-based e-mail application, the browser sends cookie information to the server, permitting the server to identify the user throughout the user's session with the application. Even though cookies often simplify the Internet shopping experience for the user, they remain controversial because they can also be considered an infringement on a user's privacy. Using a combination of cookies and user-supplied account information, a Web site can learn a lot about a user and potentially sell what it knows to some third party.
Cookies can also be used to gather information about a particular user's behavior across a large number of Web sites. Web pages that display banner ads use HTTP request messages to obtain the banner ads from the HTTP server of an advertising agency. Each of the requests to the advertising agency's HTTP server can contain a cookie that is managed by the advertising agency. Because major internet advertising agencies supply banner ads to many Web sites, the agency can build a profile about an individual's browsing patterns across multiple sites.
