2.7.4. Cookie

2.7.4.1. Introduction

Cookie (Plural Cookies), the type is “small text file”, refers to the data stored on the user’s local terminal by some websites in order to identify the user’s identity.

2.7.4.2. Properties

2.7.4.2.1. name

The name of the cookie.

2.7.4.2.2. value

The value of the cookie.

2.7.4.2.3. expires

When the Expires attribute is default, it means that it is a session cookie, which expires when the user closes the browser.

2.7.4.2.4. max-age

max-age can be positive, negative, or 0. If the max-age attribute is positive, the browser will persist it, when the max-age attribute is negative, it means that the cookie is only a session cookie. When max-age is 0, the cookie will be deleted immediately. When both Expires and max-age exist, max-age takes precedence.

2.7.4.2.5. domain

Specify the domain name of the cookie, the default is the current domain name. When the domain is set, it can be set to itself and its parent domain, and the child domain can access the cookies of the parent domain, but not vice versa.

2.7.4.2.6. path

Specify a URL path, which must appear in the path of the resource to be requested before the corresponding cookie can be sent.

2.7.4.2.7. secure

Can only be transmitted via HTTPS.

2.7.4.2.8. httponly

Restricting cookies to be read only during HTTP transmission, preventing XSS attacks to a certain extent.

2.7.4.2.9. SameSite

SameSite supports Strict / Lax / None three values. Strict is the strictest, completely bans third-party cookies, and will not send cookies under any circumstances when cross-site. Lax allows some third-party requests to carry cookies, mainly in three cases: link, preload, and GET form. The SameSite property of the cookie is None, and when Secure is set, the cookie will be sent regardless of whether it is cross-site.