What is the difference between a request attribute and a cookie?

First of all by adding the code:

    before((req, res) -> {
        if (req.cookie("username") != null) {
            req.attribute("username", req.cookie("username"));
        }
    });

He solves the TODO he wrote earlier:

TODO:this username is tied to cookie implementation

Why changing cookie to request is better.

Consider reading answer here at first:

http://stackoverflow.com/questions/911529/how-the-attribute-field-of-a-httpservletrequest-maps-to-a-raw-http-request

You can see from the answer there, that you cannot see request.attribute in HTTP request from browser, by the reasons explained in the answer above:

Quote:

attributes are not present in any way in the HTTP request as it travels over the wire. They are created (by your code) when processing the request.

The cookie is seen to anyone and can be used by hackers, but request attribute is NOT, that is why Craig put that TODO, because ultimately he wants to use request.attribute because it is safer and better....

Do you see where it goes?

Cookie can be attached up to forever to selected pages and will be there seen to anyone from browser.

request.attribute will be seen only on server side and only to you, that is why it is safer ...

All I can get with my knowledge, hope it makes sense ...