Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #29940
| From | Stefan Weiss <krewecherl@gmail.com> |
|---|---|
| Newsgroups | comp.lang.javascript |
| Subject | Re: Difference between client and server side cookie |
| Date | 2016-03-12 16:19 +0100 |
| Organization | albasani.net |
| Message-ID | <nc1c2q$bnq$1@news.albasani.net> (permalink) |
| References | <e4e57778-cb14-4e10-8ffd-61fe8ad89240@googlegroups.com> |
On 03/12/2016 14:38, bit-naughty@hotmail.com wrote:
> Is there any difference between the 2, as in one set by JS on the
> browser side, and one set in PHP code running on the server? They both
> result in exactly the same thing happening, right? (ie. for PHP the
> required data just travels over HTTP to the browser, which then does
> whatever?)
Normally, there is no difference. You can read and set cookies on the
server and on the client (with JS).
The situation changes when the cookie set by the server uses the
HttpOnly flag. If the browser supports this extension (and all major
browsers do), they will not let scripting languages read or change the
value of that cookie. See example below.
> If, for example I set "x=3" in a cookie in JS, can I then set "x=4"
> in PHP on the server side? Or even just check what "x" is? How?
Server-side code (PHP):
setcookie("one", "1");
setcookie("two", "2", 0, "", "", false, true); // HttpOnly
setcookie("three", "3");
HTTP response header:
Set-Cookie: one=1
Set-Cookie: two=2; httponly
Set-Cookie: three=3
Client (JS):
console.log(document.cookie); // "one=1; three=3"
document.cookie = "one=11";
console.log(document.cookie); // "one=11; three=3"
document.cookie = "two=22";
console.log(document.cookie); // "one=11; three=3" (!!)
document.cookie = "three=33";
console.log(document.cookie); // "one=11; three=33"
Next HTTP request header:
Cookie: one=11; two=2; three=33
Server-side code (PHP):
var_export($_COOKIE);
// array (
// 'one' => '11',
// 'two' => '2',
// 'three' => '33',
// )
Note that the client was unable to see or modify the value of the "two"
cookie because it was protected by the HttpOnly flag.
- stefan
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-12 05:38 -0800
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 15:02 +0100
Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-12 16:19 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 23:32 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-12 20:23 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 10:48 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 10:42 +0000
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 12:05 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 11:46 +0000
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 13:46 +0100
Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:07 -0700
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 16:34 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 23:42 +0000
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 01:54 +0100
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 10:36 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 11:43 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 10:21 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 15:01 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 11:52 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 17:06 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 13:17 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 19:43 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 16:17 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:22 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 19:38 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:44 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 21:49 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 10:18 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-15 11:39 -0300
Re: Difference between client and server side cookie John Harris <niam@jghnorth.org.uk.invalid> - 2016-03-15 09:40 +0000
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 12:08 +0100
Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-15 13:22 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 15:53 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-13 13:51 -0300
Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:09 -0700
csiph-web