Due to weird domain/subdomain cookie issues that I'm getting, I'd like to know how browsers handle cookies. If they do it in different ways, it would also be nice to know the differences.
In other words - when a browser receives a cookie, that cookie MAY have a domain and a path attached to it. Or not, in which case the browser probably substitutes some defaults for them. Question 1: what are they?
Later, when the browser is about to make a request, it checks its cookies and filters out the ones it should send for that request. It does so by matching them against the requests path and domain. Question 2: what are the matching rules?
Added:
The reason I'm asking this is because I'm interested in some edge cases. Like:
- Will a cookie for
.example.com
be available forwww.example.com
? - Will a cookie for
.example.com
be available forexample.com
? - Will a cookie for
example.com
be available forwww.example.com
? - Will a cookie for
example.com
be available foranotherexample.com
? - Will
www.example.com
be able to set cookie forexample.com
? - Will
www.example.com
be able to set cookie forwww2.example.com
? - Will
www.example.com
be able to set cookie for.com
? - Etc.
Added 2:
Also, could someone suggest how I should set a cookie so that:
- It can be set by either
www.example.com
orexample.com
; - It is accessible by both
www.example.com
andexample.com
.
ベストアンサー1
Although there is the RFC 2965 (Set-Cookie2
, had already obsoleted RFC 2109) that should define the cookie nowadays, most browsers don’t fully support that but just comply to the original specification by Netscape.
There is a distinction between the Domain attribute value and the effective domain: the former is taken from the Set-Cookie
header field and the latter is the interpretation of that attribute value. According to the RFC 2965, the following should apply:
- If the Set-Cookie header field does not have a Domain attribute, the effective domain is the domain of the request.
- If there is a Domain attribute present, its value will be used as effective domain (if the value does not start with a
.
it will be added by the client).
Having the effective domain it must also domain-match the current requested domain for being set; otherwise the cookie will be revised. The same rule applies for choosing the cookies to be sent in a request.
Mapping this knowledge onto your questions, the following should apply:
- Cookie with
Domain=.example.com
will be available for www.example.com - Cookie with
Domain=.example.com
will be available for example.com - Cookie with
Domain=example.com
will be converted to.example.com
and thus will also be available for www.example.com - Cookie with
Domain=example.com
will not be available for anotherexample.com - www.example.com will be able to set cookie for example.com
- www.example.com will not be able to set cookie for www2.example.com
- www.example.com will not be able to set cookie for .com
そして、クッキーを設定したり読み取ったりするには参考文献およびexample.com.www.example.com
の場合は、それぞれとに設定します.example.com
。ただし、最初の ( .www.example.com
) は、そのドメインの下にある他のドメイン (例: foo.www.example.comまたはbar.www.example.com )からのみアクセス可能であり、 example.comの下にある他のドメイン(例: foo.example.comまたはbar.example.com.example.com
)からもアクセスできます。