Questions #1

How to protect cookies from theft and forgery?
Depends on how strict the site's security criteria are. If cookies store auxiliary data, for example, the index of the last item selected in the dropdown, the rules below can be ignored.
For payment systems, sites with private data, these rules are mandatory.

• 
  Set the httponly flag to cookies. The browser will not allow you to read and change such cookies on the Javascript client.
  
• 
  Use the secure flag. Cookies will only be transmitted over a secure connection.
  
• 
  Set a short cookie lifetime.
  
• 
  Set a short session time on the server.
  
• 
  Add a User-Agent header to the session key. Then if you steal the cookie and install it on another machine, the session key will be different.
  
• 
  Similar to the point above, but add the user's IP.
  
• 
  Sign cookies with a secret key. Add a sig field that is equal to HMAC-SHA1(cookie-body, secret_key). Check on the server that the signature matches.
  

HTTP

How is the HTTP protocol structured?
HTTP is a text protocol that runs on top of TCP/IP. HTTP consists of a request and a response. Their structures are similar: start line, headers, response body.
The start query string consists of the method, path, and protocol version:
GET /index.html HTTP/1.1

The start line of the response consists of the protocol version, the response code, and the textual transcript of the response.

HTTP/1.1 200 OK

Headers are a set of key-value pairs, such as User-Agent, Content-Type. The headers contain request metadata: user language, authorization, redirection. The Host header must always be present in the request.

The response body can be empty, or it can transfer pairs of variables, files, binary data. The body is separated from the headers by a blank line.
Write a raw request to the main Yandex
GET/HTTP/1.1
Host: ya.ru