In this paper, HTTP cookies, especially when they are used in Web mashups, are studied. A new cookie protocol named Cross Cookie is proposed. In a Cross Cookie, both information of where the cookie is originated and where the cookie is used on client-side are described. From the global perspective, universal persistent state of a Web mashup can be efficiently managed with Cross Cookie. From the localized perspective, gadgets in a Web mashup can have their persistent state distinguished even if the gadgets come from the same domain. Cross Cookie enables fine grained control on third party cookies. The new protocol extends and is backward compatible with current cookie specification.