Path: csiph.com!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Ben Bacarisse Newsgroups: comp.lang.javascript Subject: Re: Difference between client and server side cookie Date: Sun, 13 Mar 2016 23:42:41 +0000 Organization: A noiseless patient Spider Lines: 56 Message-ID: <87y49m54i6.fsf@bsb.me.uk> References: <87wpp67j6w.fsf@bsb.me.uk> <2325956.yKQUHyJ2TD@PointedEars.de> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Info: mx02.eternal-september.org; posting-host="017616aa25f81ec581c44d76d61ba2f3"; logging-data="10282"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18lvL3DIL/IibtbglFFtdyW+QrmP2aVhac=" Cancel-Lock: sha1:/9m8uMYaCJUBQVaiPJ8o1RX+owc= sha1:6g19DNVQdQ08PR9TwfiXFATYODM= X-BSB-Auth: 1.280e2f2155aacbc21eac.20160313234241GMT.87y49m54i6.fsf@bsb.me.uk Xref: csiph.com comp.lang.javascript:29970 Thomas 'PointedEars' Lahn writes: > Ben Bacarisse wrote: > >> He's saying that there are sometimes cookies "on the server" -- >> specifically they are sent there every time a client makes a request for >> which a cookie is relevant. > > In fact, only cookie *names* and *values* are sent with every HTTP request > that applies to their “domain”, “path” and “secure” attributes, unless they > have expired (as specified by the “expires” attribute in a former HTTP > response header “Set-Cookie” field value or in the value assigned to the > document.cookie property). > >> Where are they while the server is using them if not "on the server"? > > Still stored on the client machine. And on the server while the server is processing the request. > Cookies are data (stored in local > files) only whose *names* and *values* are incorporated into a HTTP request > header “Cookie” field value. But it is not a cookie only when in some client's store. The RFC (6265) defines a cookie as a name/value pair and it is still a cookie as that name/value pair is sent over the wire. This is clear from the language the RFC uses: "The semantics of individual cookies in the Cookie header are not defined" "if the Cookie header contains two cookies with the same name" "if the user agent fails to return one or more cookies in the Cookie header" "The active network attacker can intercept these cookies" "the user agent will include that cookie in HTTP requests" and so on. It is perfectly reasonable to talk of the cookie in transit, in the header and arriving (to be stored however temporarily) on the server. >> It's a small point, but it's not wrong. > > Yes, it is. > > The RFC is definitive. If this Wikipedia article contradicts it, Wikipedia needs to be corrected. -- Ben.