Browser cookies are small pieces of data that a website stores in your browser so it can recognise the same browser on its next request. For sneaker botting, we need to understand them because a store can use them to tie your cart, session and checkout together, and, as we read HTTP, a program that checks out for you has to return them as a browser does. Here is what they hold, how long they last and where they matter.
- Size: According to RFC 6265, the standard that defines cookies, general-use user agents such as browsers should support at least 4,096 bytes per cookie, 50 cookies per domain and 3,000 in total.
- Cart lifetime: Shopify’s cookie page lists its cart cookie with a lifetime of 2 weeks.
- Bot-management lifetime: Cloudflare’s cookie page says its bot-management cookie expires after 30 minutes of continuous inactivity.
- Consent: The UK Information Commissioner’s Office lists 5 circumstances where no consent is needed, and gives a shopping basket as an example of one of them.
What are browser cookies?
A browser cookie is a short name and value that a website asks your browser to hold on to, and the browser may send it back to the same server with later requests. MDN Web Docs defines a cookie like this:
A cookie (also known as a web cookie or browser cookie) is a small piece of data a server sends to a user’s web browser.
That matters because, as MDN’s guide to HTTP cookies says, by default the HTTP protocol is stateless. Each request arrives with no memory of the last one, so the server hands the browser a value, the browser sends it back, and the server can tell the requests belong together. Not the kind you dunk in milk, then, but the kind a server writes.
What do browser cookies actually store?
A cookie stores a name and a value that the server can read when the browser sends it back. In the sign-in example in MDN’s guide, the server responds with a cookie containing a session ID, and that ID is how it recognises the same browser on the next page. MDN lists three main jobs for cookies: session management (sign-in status, shopping cart contents), personalization (display language, theme) and tracking.
They are small. RFC 6265 says general-use user agents should support at least 4,096 bytes per cookie, at least 50 cookies per domain and at least 3,000 in total. Those are minimums, so a browser may allow more. Tracking is only one of the three jobs MDN names, next to session management and personalization.
Can a web page’s JavaScript read every cookie?
Not if the server set the HttpOnly attribute. MDN says that attribute prevents JavaScript from accessing the cookie, and that a cookie with the Secure attribute is only sent with an encrypted request over HTTPS.
Why do sneaker bots need browser cookies?
A checkout leans on browser cookies because a store can use them to tie the cart and the checkout steps into one visit. In the table Shopify publishes for the stores it powers, the cart cookie “contains information related to the user’s cart”, and another cookie holds “session and checkout information and anti-tampering data”.
A checkout bot is software that makes those same requests for you. MDN says a server will typically use cookies to determine whether different requests come from the same browser. So a bot that keeps the cookies a store sends and returns them, as a browser would, gives the store something to link its requests by. That is our reading of how HTTP works, not any retailer’s rulebook.
The network address a request comes from is a separate topic, which we cover in what sneaker proxies are. If you want to see how a checkout bot is set up, NikeShoeBot has step-by-step guides for each supported retailer, and what to do before you buy a sneaker bot has the steps to take first.
How do anti-bot systems use cookies?
Cloudflare’s bot protection stores some of its own check data in cookies, and its documentation lists two of them. According to Cloudflare’s cookie documentation, it places a __cf_bm cookie on devices that visit sites protected by Bot Management or Bot Fight Mode. That cookie expires after 30 minutes of continuous inactivity and contains information related to the calculation of Cloudflare’s proprietary bot score.
The same page says the information in that cookie, other than time-related information, is encrypted and can only be decrypted by Cloudflare. It also says JavaScript detections are stored in a second cookie, cf_clearance. In plain terms, one cookie carries data used to calculate a bot score and the other stores JavaScript detections, and only Cloudflare can decrypt what the first one holds, apart from the time-related information.
How any one retailer weighs cookies against other signals is not covered here, because none of the sources behind this post describes it. This post sticks to what the vendors document.
How long do browser cookies last?
A cookie lasts until its expiry date, until its Max-Age runs out or, if it has neither, until the browser session ends. MDN says permanent cookies are deleted after the date in the Expires attribute or the period in the Max-Age attribute, and its example uses Max-Age=2592000. That is 2,592,000 seconds divided by 86,400 seconds in a day, which works out to 30 days.
Session cookies are deleted when the current session ends, but MDN notes that some browsers restore sessions on restart, which can make them last indefinitely. The table shows how far lifetimes spread, using the rows Shopify and Cloudflare list on their own cookie pages as of 7 October 2026, plus MDN’s Max-Age example. A one-minute test cookie, a 30-minute bot-management cookie, a 2-week cart cookie and a 1-year essential cookie can all be in the same browser at once.
| Cookie | Set by | What the vendor says it does | Lifetime listed |
|---|---|---|---|
| cart | Shopify | Contains information related to the user’s cart | 2 weeks (14 days) |
| cart_currency | Shopify | Initializes a new empty cart with the same currency after a checkout is completed | 2 weeks (14 days) |
| _shopify_essential | Shopify | Session and checkout information and anti-tampering data | 1 year |
| _shopify_test | Shopify | Checks cookie capabilities on the client | 1 minute |
| discount_code | Shopify | Stores a discount code from a URL parameter for the next checkout | Session |
| __cf_bm | Cloudflare | Information related to the bot score calculation | 30 minutes of continuous inactivity |
| Max-Age=2592000 | MDN example | 2,592,000 seconds divided by 86,400 seconds per day | 30 days |
What does the SameSite attribute do?
MDN says the SameSite attribute lets servers specify whether and when cookies are sent with cross-site requests. If no SameSite attribute is set, MDN says, the cookie is treated as Lax by default.
Do browser cookies need your consent?
In the UK, a site does not always need your consent to set a cookie. The UK Information Commissioner’s Office says you can store or access information in five circumstances without the user’s consent, and one of them is the “strictly necessary” exception for what is essential to provide the service the user requests. Its own example is remembering the goods a user wishes to buy when they go to the online checkout or add goods to their shopping basket.
Cookies outside those exceptions need consent, and the ICO’s guidance on the exceptions says that if a use goes beyond them, the site must get consent. MDN lists the GDPR and the ePrivacy Directive in the EU and the California Consumer Privacy Act as rules that cover cookies. The ICO speaks only for the UK, so read its list as the UK position, not a global one.
What happens when you clear or block browser cookies?
When you clear or block a site’s cookies, your browser has nothing to send back, so the site cannot use them to recognise it. MDN describes a related case from the server’s side: if the session ID is not valid, it is deleted and the user is shown a generic version of the page, or perhaps an “access denied” message and a request to sign in again.
For a store, that touches the cart. Shopify lists cart information under its cart cookie, and the ICO gives remembering a basket as an example under its strictly necessary exception, so the cart is one of the things a store keeps in cookies. Neither source says what a store does once they are cleared.
A browser may store the cookies it receives, so they sit on whichever machine runs it, whether that is your own computer or another machine such as one of the sneaker servers we cover. If you would rather learn this alongside other people, our sneaker cook group post is a place to start.
