JavaScript 2.0-The Complete Reference, Second ... - freecodingtutorial

When a user connects to a site, the browser checks its list of cookies for a match. A match is
determined by examination of the URL of the current request. If the domain and path in a
cookie match the given URL (in some loose sense), the cookie‘s name= token is sent to the
server. If multiple cookies match, the browser includes each match in a semicolon-separated
string. For example, it might return
username=fritz; favoritecolor=green; prefersmenus=
Be aware that we are glossing over some subtleties with regard to how the browser determines
a match. Full details are found at http://home.netscape.com/newsref/std/cookie_spec.html.
Several RFCs (2109, 2965, and especially 2964) also have bearing on cookie technology, but
the Netscape specification is the one widely used.
Cookies in JavaScript
One nice thing about cookies is that nearly every browser in existence with JavaScript support
also provides scripts access to cookies. Cookies are exposed as the cookie property of the
Document object. This property is both readable and writeable.
Setting Cookies
When you assign a string to document.cookie, the browser parses it as a cookie and adds it to
its list of cookies. For example,
document.cookie = "username=fritz; expires=Sun, 01-Dec-2005 08:00:00
GMT;
path=
sets a persistent cookie named username with value ―fritz‖ that expires in 2005 and will be sent
whenever a request is made for a file under the ―/home‖ directory on the current Web server.
Whenever you omit the optional cookie fields (like secure or domain), the browser fills them in
automatically with reasonable defaults—for example, the domain of the current URL and path
to the current document. It is possible, but not recommended, to set multiple cookies of the
same name with differing paths. If you do so, then both values may be returned in the cookie
string, and if so you have to check to see if you can tell the difference using their order in the
string. Attempting to set cookies for inappropriate domains or paths (for example, domain
names other than domains closely related to the current URL) will silently fail.
The cookie parsing routines used by the browser assume that any cookies you set are well
formed. The name/value pair must not contain any whitespace characters, commas, or
semicolons. Using such characters can cause the cookie to be truncated or even discarded. It
is common practice to encode cookie values that might be problematic before setting them in
the cookie. The global escape() and unescape() methods available in all major browsers are
usually sufficient for the job. These functions URL-encode and URL-decode the strings that are
passed to them as arguments and return the result. Problematic characters such as
whitespace, commas, and semicolons are replaced with their equivalent in URL escape codes.
For example, a space character is encoded as %20. The following code illustrates their use:
var problemString = "Get rid of , ; and ?";
var encodedString = escape(problemString);
alert("Encoded: " + encodedString + "\n" + "Decoded: " +
unescape(encodedString));