zoukankan      html  css  js  c++  java
  • How do browser cookie domains work?

    How do browser cookie domains work?

    答案一

    Although there is the RFC 2965 (Set-Cookie2, had already obsoleted RFC 2109) that should define the cookie nowadays, most browsers don’t fully support that but just comply to the original specification by Netscape.

    There is a distinction between the Domain attribute value and the effective domain: the former is taken from the Set-Cookie header field and the latter is the interpretation of that attribute value. According to the RFC 2965, the following should apply:

    • If the Set-Cookie header field does not have a Domain attribute, the effective domain is the domain of the request.
    • If there is a Domain attribute present, its value will be used as effective domain (if the value does not start with a . it will be added by the client).

    Having the effective domain it must also domain-match the current requested domain for being set; otherwise the cookie will be revised. The same rule applies for choosing the cookies to be sent in a request.


    Mapping this knowledge onto your questions, the following should apply:

    • Cookie with Domain=.example.com will be available for www.example.com
    • Cookie with Domain=.example.com will be available for example.com
    • Cookie with Domain=example.com will be converted to .example.com and thus will also be available for www.example.com
    • Cookie with Domain=example.com will not be available for anotherexample.com
    • www.example.com will be able to set cookie for example.com
    • www.example.com will not be able to set cookie for www2.example.com
    • www.example.com will not be able to set cookie for .com

    And to set and read a cookie for/by www.example.com and example.com, set it for .www.example.com and .example.com respectively.

    But the first (.www.example.com) will only be accessible for other domains below that domain (e.g. foo.www.example.com or bar.www.example.com)

    where .example.com can also be accessed by any other domain below example.com (e.g. foo.example.com or bar.example.com).

    答案二

    The previous answers are a little outdated.

    RFC 6265 was published in 2011, based on the browser consensus一致意见 at that time. Since then, there has been some complication with public suffix domains. I've written an article explaining the current situation - http://bayou.io/draft/cookie.domain.html

    To summarize, rules to follow regarding cookie domain:

    • The origin domain of a cookie is the domain of the originating request.

    • If the origin domain is an IP, the cookie's domain attribute must not be set.

    • If a cookie's domain attribute is not set, the cookie is only applicable to its origin domain.

    • If a cookie's domain attribute is set,

      • the cookie is applicable to that domain and all its subdomains;
      • the cookie's domain must be the same as, or a parent of, the origin domain
      • the cookie's domain must not be a TLD, a public suffix, or a parent of a public suffix.

    It can be derived that a cookie is always applicable to its origin domain.

    The cookie domain should not have a leading dot, as in .foo.com - simply use foo.com

    As an example,

    • x.y.z.com can set a cookie domain to itself or parents - x.y.z.com, y.z.com, z.com. But not com, which is a public suffix.
    • a cookie with domain=y.z.com is applicable to y.z.com, x.y.z.com, a.x.y.z.com etc.

    Examples of public suffixes - com, edu, uk, co.uk, blogspot.com, compute.amazonaws.com

    x.y.z.com的父域名有y.z.com以及z.com 

  • 相关阅读:
    数据结构 字符串的长度
    滚动条
    git push 一直卡在 writing objects 然后 就提交失败 提示:unexpected-disconnect-while-reading-sideband-packet
    vue中的防抖和节流
    html5中output元素详解
    手写 apply call bind 三个方法
    js中的陷阱!!!
    display:inline-block元素之间空隙的产生原因和解决办法
    git push到Gitee的时候上传不成功,可能是本地文件夹与远程仓库不同步
    axios没有实现jsonp这个功能,基于axios自己扩展一个
  • 原文地址:https://www.cnblogs.com/chucklu/p/8989560.html
Copyright © 2011-2022 走看看