The encyclopedia · Software & IT · Technical decision · 1994-2011
Netscape's cookie stored session state in the browser, making stateless HTTP hold a cart
Netscape moved the session token into a client-held cookie so a stateless server could still run a shopping cart.
Netscape
the move
The problem is that HTTP has no memory: a shop cannot know who is asking for a cart. The obvious fix is a server-side session, where the server keeps a table linking a session id to a cart. That works until you need many servers, because every request must hit the one machine holding the state.
Netscape's Lou Montulli moved the state into the browser instead. A cookie is a tiny token the server hands to the client, and the browser is required to send it back untouched on each request. MCI, building an e-commerce app, asked Netscape for exactly this so its servers would not have to hold partial transaction state.
The result is that the stateful thing travels inside the stateless protocol. Any server can take any request, read the cookie, and reconstruct the cart. That single choice kept HTTP simple while giving it the memory e-commerce needs.
why it works
- Because the state rides with the client, no request has to be routed to a specific server, which lets the shop scale horizontally without session affinity.
- The browser does the remembering for free, so the protocol did not need to change; the fix fits inside an existing header.
- It also became the tracking mechanism advertisers needed, which is why every site adopted it so fast.
- MCI's concrete requirement (servers must not keep partial transaction state) gave Netscape a real constraint to design against.
what transfers
To add state to a stateless system, relocate the state to the side that already travels with every interaction instead of building a bigger server-side session store.
what came after
Cookies shipped in Mosaic Netscape in October 1994 and in Internet Explorer by 1995. An IETF working group standardized them as RFC 2109 in 1997 and RFC 6265 in 2011. They became the default way to carry sessions and identity on the web, but also the mechanism behind third-party tracking, which later triggered privacy regulation and the cookie deprecation battles of the 2020s.
references
spotted an error? The archive wants to know.