javascript

Chapter 19: Client - Side Storage
❑
❑
❑
Path — The path within the specified domain for which the cookie should be sent to the server.
For example, you can specify that the cookie only be accessible from http://www.wrox.com/
books/ so pages at http://www.wrox.com won ’ t send the cookie information, even though the
request comes from the same domain.
Expiration — A timestamp indicating when the cookie should be deleted (that is, when it should
stop being sent to the server). By default, all cookies are deleted when the browser session ends;
however, it is possible to set another time for the deletion. This value is set as a date in GMT
format (Wdy, DD - Mon - YYYY HH:MM:SS GMT) and specifies an exact time when the cookie
should be deleted. Because of this, a cookie can remain on a user ’ s machine even after the
browser is closed. Cookies can be deleted immediately by setting an expiration date that has
already occurred.
Secure flag — When specified, the cookie information is sent to the server only if an SSL
connection is used. For instance, requests to https://www.wrox.com should send cookie
information, whereas requests to http://www.wrox.com should not.
Each piece of information is specified as part of the Set - Cookie header using a semicolon - space
combination to separate each section, as shown in the following example:
HTTP/1.1 200 OK
Content-type: text/html
Set-Cookie: name=value; expires=Mon, 22-Jan-07 07:10:24 GMT; domain=.wrox.com
Other-header: other-header-value
This header specifies a cookie called “ name ” that expires on Monday, January 22, 2007, at 7:10:24 GMT
and is valid for www.wrox.com as well as any other subdomains of wrox.com such as p2p.wrox.com .
The secure flag is the only part of a cookie that is not a name - value pair; the word “ secure ” is simply
included. Consider the following example:
HTTP/1.1 200 OK
Content-type: text/html
Set-Cookie: name=value; domain=.wrox.com; path=/; secure
Other-header: other-header-value
Here, a cookie is created that is valid for all subdomains of wrox.com and all pages on that domain
(as specified by the path argument). This cookie can only be transmitted over an SSL connection
because the secure flag is included.
It ’ s important to note that the domain, path, expiration date, and secure flag are indications to the
browser as to when the cookie should be sent with a request. These arguments are not actually sent as
part of the cookie information to the server; only the name - value pairs are sent.
Cookies in JavaScript
Dealing with cookies in JavaScript is a little complicated because of a notoriously poor interface, the
BOM ’ s document.cookie property. This property is unique in that it behaves very differently
depending on how it is used. When used to retrieve the property value, document.cookie returns a
619