Stored state returns under matching rules
A server sets name–value state through Set-Cookie; applicable later requests return it in Cookie. Values can be preferences or references to server-side sessions, without storing a complete user profile in the browser.
Domain controls host scope and omission normally limits it to the setting host; Path also affects delivery. Cookies do not isolate by port, and Path is not a reliable security partition between mutually distrusting applications.
References: [1]
Protection attributes govern different paths
Secure restricts delivery to secure channels; HttpOnly restricts non-HTTP access such as script reading. HttpOnly does not prevent appropriate HTTP requests carrying the cookie, so it alone does not rule out unintended session actions.
SameSite adds cross-site delivery conditions involving mode, navigation and context. Same-site still differs from same-origin and does not replace authorization or request binding. Its effect depends on the interaction, not merely the presence of the attribute.
Retention and server acceptance expire separately
Expires gives a date and Max-Age a duration; RFC 6265 gives Max-Age precedence when both occur. Deletion, storage pressure or privacy policy can remove a cookie earlier than its stated expiry.
A server session can independently end, expire or be revoked. A retained cookie need not remain acceptable, and browser deletion does not itself revoke every copied credential. Server-side session conditions still need enforcement.