Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #29940

Re: Difference between client and server side cookie

Show key headers only | View raw

On 03/12/2016 14:38, bit-naughty@hotmail.com wrote:
> Is there any difference between the 2, as in one set by JS on the
> browser side, and one set in PHP code running on the server? They both
> result in exactly the same thing happening, right? (ie. for PHP the
> required data just travels over HTTP to the browser, which then does
> whatever?)

Normally, there is no difference. You can read and set cookies on the
server and on the client (with JS).
The situation changes when the cookie set by the server uses the
HttpOnly flag. If the browser supports this extension (and all major
browsers do), they will not let scripting languages read or change the
value of that cookie. See example below.

> If, for example I set "x=3" in a cookie in JS, can I then set "x=4"
> in PHP on the server side? Or even just check what "x" is? How?

Server-side code (PHP):

  setcookie("one",   "1");
  setcookie("two",   "2", 0, "", "", false, true);  // HttpOnly
  setcookie("three", "3");

HTTP response header:

  Set-Cookie: one=1
  Set-Cookie: two=2; httponly
  Set-Cookie: three=3

Client (JS):

  console.log(document.cookie);         // "one=1; three=3"

  document.cookie = "one=11";
  console.log(document.cookie);         // "one=11; three=3"

  document.cookie = "two=22";
  console.log(document.cookie);         // "one=11; three=3" (!!)

  document.cookie = "three=33";
  console.log(document.cookie);         // "one=11; three=33"

Next HTTP request header:

  Cookie: one=11; two=2; three=33

Server-side code (PHP):

  var_export($_COOKIE);

  // array (
  //   'one' => '11',
  //   'two' => '2',
  //   'three' => '33',
  // )


Note that the client was unable to see or modify the value of the "two"
cookie because it was protected by the HttpOnly flag.


- stefan

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-12 05:38 -0800
  Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 15:02 +0100
  Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-12 16:19 +0100
    Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 23:32 +0100
      Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-12 20:23 -0300
        Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 10:48 +0100
          Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 10:42 +0000
            Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 12:05 +0100
              Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 11:46 +0000
            Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 13:46 +0100
              Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:07 -0700
                Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 16:34 +0100
              Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 23:42 +0000
                Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 01:54 +0100
                Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 10:36 +0100
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 11:43 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 10:21 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 15:01 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 11:52 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 17:06 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 13:17 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 19:43 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 16:17 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:22 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 19:38 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:44 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 21:49 -0300
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 10:18 +0100
                Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-15 11:39 -0300
                Re: Difference between client and server side cookie John Harris <niam@jghnorth.org.uk.invalid> - 2016-03-15 09:40 +0000
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 12:08 +0100
                Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-15 13:22 +0100
                Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 15:53 +0100
          Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-13 13:51 -0300
    Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:09 -0700

csiph-web