Beside the name/value pair, a cookie may also contain an expiration date, a path, a domain name, and whether the cookie is intended only for encrypted connections. RFC 2965 also specifies that cookies must have a mandatory version number, but this is usually omitted. These pieces of data follow the codice_15 pair and are separated by semicolons. For example, a cookie can be created by the server by sending a line codice_16.

The domain and path tell the browser that the cookie has to be sent back to the server when requesting URLs of a given domain and path. If not specified, they default to the domain and path of the object that was requested. As a result, the domain and path strings may tell the browser to send the cookie when it normally would not. For security reasons, the cookie is accepted only if the server is a member of the domain specified by the domain string. 

Cookies are actually identified by the combination of their name, domain, and path, as opposed to only their name (the original Netscape specification considers only their name and path). In other words, same name but different domains or paths identify different cookies with possibly different values. As a result, cookie values are changed only if a new value is given for the same name, domain, and path.

The expiration date tells the browser when to delete the cookie. If no expiration date is provided, the cookie is deleted at the end of the user session, that is, when the user quits the browser. As a result, specifying an expiration date is a means for making cookies survive across browser sessions. For this reason, cookies that have an expiration date are called "persistent".

The expiration date is specified in the "Wdy, DD-Mon-YYYY HH:MM:SS GMT" format. As an example, the following is a cookie sent by a Web server (the value string has been changed):

codice_17

The name of this particular cookie is codice_18, while its value is the string codice_19. The server can use an arbitrary string as the value of a cookie. The server may collapse the value of a number of variables in a single string, like for example codice_20. The path and domain strings codice_21 and codice_22 tell the browser to send the cookie when requesting an arbitrary page of the domain codice_22, with an arbitrary path.

Browser settings
Cookie expiry
Setting a cookie
Cookie attributes