user34062: I am getting a message when I start bitcoind :
Config options rpcuser and rpcpassword will soon be deprecated. Locally-run instances may remove rpcuser to use cookie-based auth, or may be replaced with rpcauth. Please see share/rpcuser for rpcauth auth generation
What is cookie based auth and how can I use it ?
Thanks

user92872: I was struggling with this same difficulty and managed to make it work. Obviously, bitcoin-cli must be made aware of credentials to use when making RPC calls, and I am guessing here that bitcoin-cli expects the credentials specified with variablies rpcuser and rpcpassword. However, these two variables are unnecessary to allow one to authenticate when making an RPC call via HTTP. So for bitcoin-cli's sake, bitcoind generates the .cookie file when rpcuser and rpcpassword are not defined in bitcoin.conf
Another thing I wanted to point out is that one can actually have a password of their choosing when using ./share/rpcauth/rpcauth.py to generate credentials. Simply pass to it two parameters as such ./share/rpcauth/rpcauth.py <username> <password> and you'll have it.

user101304: I did not happen to have a full implementation of bitcoin, but found the rpcauth.py script in the "share" directory under a litecoin build that I have. I seems to be coin agnostic and worked great!

user49736: In the recent version of Bitcoin Core, the name of script is rpcauth.py and its located in ./bitcoin/share/rpcauth/rpcauth.py (available on Bitcoin Core's github repository as well, share/rpcauth/rpcauth.py).

user7412: The http remote procedure call (RPC) interface enforces "basic access authentication". "Cookie-based" authentication is misleading because it doesn't actually use http cookies. The short story is that on startup if you don't otherwise specify credentials via rpcuser+rpcpassword, bitcoind will write a file named ".cookie" in the data directory with contents "__cookie__:abc123" where __cookie__ is the basic auth username and abc123 is a randomly generated password. On shutdown, bitcoind deletes the file.

user41314: Cookie based authentication is used when no rpc password is provided. The 0.12 release of Bitcoin Core had the following to say about it:

When no -rpcpassword is specified, the daemon now uses a special
  ‘cookie’ file for authentication. This file is generated with random
  content when the daemon starts, and deleted when it exits. Its
  contents are used as authentication token. Read access to this file
  controls who can access through RPC. By default it is stored in the
  data directory but its location can be overridden with the option
  -rpccookiefile.
This is similar to Tor’s CookieAuthentication: see
  https://www.torproject.org/docs/tor-manual.html.en
This allows running bitcoind without having to do any manual
  configuration.

If all you use is bitcoin-cli without need for the RPC user/password stuff, you should probably just comment out or remove rpcuser=XXX and rpcpassword=YYY from bitcoin.conf and restart bitcoin. It "should just work [tm]".
If you need a specified rpc user/pass combo, you need to switch to using rpcauth instead of rpcuser/rpcpassword. 
The rpcauth is described as

Username and hashed password for JSON-RPC connections. The field  comes in the format: <USERNAME>:<SALT>$<HASH>. A canonical python script is included in share/rpcuser. This option can be specified multiple times

In share/rpcuser (on github) there is a Python script which lets you create such a user/password combo (note that you are given the password, you do not get to specify it yourself). 
Grab that python script, then run it. E.g.
$ python ./rpcuser.py foo
String to be appended to bitcoin.conf:
rpcauth=foo:a14191e6892facf70686a397b126423$ddd6f7480817bd6f8083a2e07e24b93c4d74e667f3a001df26c5dd0ef5eafd0d
Your password:
VX3z87LBVc_X7NBLABLABLABLA

Then replace rpcuser with foo and rpcpassword with VX3z87LBVc_X7NBLABLABLABLA wherever you are connecting to the bitcoind RPC.

34062: <p>I am getting a message when I start bitcoind :</p>

<p><code>Config options rpcuser and rpcpassword will soon be deprecated. Locally-run instances may remove rpcuser to use cookie-based auth, or may be replaced with rpcauth. Please see share/rpcuser for rpcauth auth generation</code></p>

<p>What is cookie based auth and how can I use it ?</p>

<p>Thanks</p>
 92872: <p>I was struggling with this same difficulty and managed to make it work. Obviously, bitcoin-cli must be made aware of credentials to use when making RPC calls, and I am guessing here that bitcoin-cli expects the credentials specified with variablies rpcuser and rpcpassword. However, these two variables are unnecessary to allow one to authenticate when making an RPC call via HTTP. So for bitcoin-cli's sake, bitcoind generates the .cookie file when rpcuser and rpcpassword are not defined in bitcoin.conf</p>

<p>Another thing I wanted to point out is that one can actually have a password of their choosing when using ./share/rpcauth/rpcauth.py to generate credentials. Simply pass to it two parameters as such <code>./share/rpcauth/rpcauth.py &lt;username&gt; &lt;password&gt;</code> and you'll have it.</p>
 101304: <p>I did not happen to have a full implementation of bitcoin, but found the rpcauth.py script in the &quot;share&quot; directory under a litecoin build that I have. I seems to be coin agnostic and worked great!</p>
 49736: <p>In the recent version of Bitcoin Core, the name of script is <code>rpcauth.py</code> and its located in <code>./bitcoin/share/rpcauth/rpcauth.py</code> (available on <a href="http://github.com/bitcoin/bitcoin" rel="nofollow noreferrer">Bitcoin Core's github repository</a> as well, <a href="https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py" rel="nofollow noreferrer">share/rpcauth/rpcauth.py</a>).</p>
 7412: <p>The http remote procedure call (RPC) interface enforces <a href="https://en.wikipedia.org/wiki/Basic_access_authentication" rel="nofollow noreferrer">"basic access authentication"</a>. "Cookie-based" authentication is misleading because it doesn't actually use <a href="https://en.wikipedia.org/wiki/HTTP_cookie" rel="nofollow noreferrer">http cookies</a>. The short story is that on startup if you don't otherwise specify credentials via <code>rpcuser</code>+<code>rpcpassword</code>, bitcoind will write a file named ".cookie" in the data directory with contents "__cookie__:abc123" where __cookie__ is the basic auth username and abc123 is a randomly generated password. On shutdown, bitcoind deletes the file.</p>
 41314: <p>Cookie based authentication is used when no rpc password is provided. The 0.12 release of Bitcoin Core had the following to say about it:</p>

<blockquote>
  <p>When no -rpcpassword is specified, the daemon now uses a special
  ‘cookie’ file for authentication. This file is generated with random
  content when the daemon starts, and deleted when it exits. Its
  contents are used as authentication token. Read access to this file
  controls who can access through RPC. By default it is stored in the
  data directory but its location can be overridden with the option
  -rpccookiefile.</p>
  
  <p>This is similar to Tor’s CookieAuthentication: see
  <a href="https://www.torproject.org/docs/tor-manual.html.en" rel="noreferrer">https://www.torproject.org/docs/tor-manual.html.en</a></p>
  
  <p>This allows running bitcoind without having to do any manual
  configuration.</p>
</blockquote>

<p>If all you use is <code>bitcoin-cli</code> without need for the RPC user/password stuff, you should probably just comment out or remove <code>rpcuser=XXX</code> and <code>rpcpassword=YYY</code> from <code>bitcoin.conf</code> and restart bitcoin. It "should just work [tm]".</p>

<p>If you need a specified rpc user/pass combo, you need to switch to using <code>rpcauth</code> instead of <code>rpcuser</code>/<code>rpcpassword</code>. </p>

<p>The <code>rpcauth</code> is described as</p>

<blockquote>
  <p>Username and hashed password for JSON-RPC connections. The field  comes in the format: <code>&lt;USERNAME&gt;:&lt;SALT&gt;$&lt;HASH&gt;</code>. A canonical python script is included in share/rpcuser. This option can be specified multiple times</p>
</blockquote>

<p>In <code>share/rpcuser</code> (<a href="https://github.com/bitcoin/bitcoin/blob/master/share/rpcauth/rpcauth.py" rel="noreferrer">on github</a>) there is a Python script which lets you create such a user/password combo (note that you are <strong>given</strong> the password, you do not get to specify it yourself). </p>

<p>Grab that python script, then run it. E.g.</p>

<pre><code>$ python ./rpcuser.py foo
String to be appended to bitcoin.conf:
rpcauth=foo:a14191e6892facf70686a397b126423$ddd6f7480817bd6f8083a2e07e24b93c4d74e667f3a001df26c5dd0ef5eafd0d
Your password:
VX3z87LBVc_X7NBLABLABLABLA
</code></pre>

<p>Then replace <code>rpcuser</code> with <code>foo</code> and <code>rpcpassword</code> with <code>VX3z87LBVc_X7NBLABLABLABLA</code> wherever you are connecting to the bitcoind RPC.</p>
