Cookie is a small piece of data sent from a server and stored in the browser. Browser sends cookie back with each subsequent request based on set of rules. Few of the common examples
ASP.NET_SessionId is a cookie that ASP.NET uses to store a unique identifier for your session.
This is set only when user tries to store something to the session, for example in asp.net mvc if we add this code, then we should see this cookie.
ControllerContext.HttpContext.Session.Add("a",1);
.ASPXAUTH is a cookie that asp.net uses for form authentication.
A web server specifies a cookie to be stored by sending an HTTP header called Set-Cookie. This is how response header looks.
In asp.net mvc you can use following code in order to perform set this header
Value is string in the format name=value. In the above example we have used subcookies in order to increase the number as there is limitation on number of cookie.
Value is sent to the server with each subsequent request if option allows
Expires option indicates when the cookie expires and should not be sent back to the server. Without the expires option, a cookie has a lifespan of a single session as we saw in case of ASPXAUTH,ASP.NET_SessionId
Domain options indicates domains for which cookie should be sent. By default domain is set to the host name of the page setting the cookie. This is useful for case like mail.somewhere.com and finance.somewhere.com. By setting .somewhere.com cookie can be shared these sets of sites. Browser performs a trail comparison of this value and the host name to which a request is sent.
Path options is another way to control cookie. This comparison is done by comparing the option value character-by-character against the start of the request URL. If the characters match, then the Cookie header is sent.
If secure option is specified then cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol.
ASP.NET_SessionId is a cookie that ASP.NET uses to store a unique identifier for your session.
Set-Cookie: ASP.NET_SessionId=huilln20biy333vr3smug2sb; path=/; HttpOnly
This is set only when user tries to store something to the session, for example in asp.net mvc if we add this code, then we should see this cookie.
ControllerContext.HttpContext.Session.Add("a",1);
.ASPXAUTH is a cookie that asp.net uses for form authentication.
Set-Cookie: .ASPXAUTH=095F6C2AF0126AF84BD5A30AD2866328E06F61755EA6FCDEDAA5A79F9039FB38AC4812628A42C700B7E927B58CA6B50F831DA2143A06385AA422ED313CB39303C3C0DA75DCFE9BCF363B7969FCFC6B0114D362CE6C1A04C424C7B1D46A440170B1DABD47E6DD8C91D6EE64B74F5224B6; path=/; HttpOnly
A web server specifies a cookie to be stored by sending an HTTP header called Set-Cookie. This is how response header looks.
Set-Cookie: value[; expires=date][; domain=domain][; path=path][; secure] Set-Cookie: MyCompany=SessionKey={some unique id}&UserName=MyName&UserId=MyId; domain=.somewhere.com; path=/
In asp.net mvc you can use following code in order to perform set this header
var httpCookie = new HttpCookie("MyCompany", "SessionKey=something&UserName=MyName"); httpCookie.Values["UserId"] = "MyId"; httpCookie.Expires = DateTime.Today.AddDays(1); httpCookie.Domain = "bogus.com"; httpCookie.Path = "/product"; httpCookie.Secure = true; ControllerContext.HttpContext.Response.Cookies.Add( httpCookie );
Value is string in the format name=value. In the above example we have used subcookies in order to increase the number as there is limitation on number of cookie.
Value is sent to the server with each subsequent request if option allows
Cookie: MyCompany=SessionKey={some unique id}&UserName=MyName&UserId=MyId;Each of the options after cookie value are separated by semicolon and space.
Expires option indicates when the cookie expires and should not be sent back to the server. Without the expires option, a cookie has a lifespan of a single session as we saw in case of ASPXAUTH,ASP.NET_SessionId
Domain options indicates domains for which cookie should be sent. By default domain is set to the host name of the page setting the cookie. This is useful for case like mail.somewhere.com and finance.somewhere.com. By setting .somewhere.com cookie can be shared these sets of sites. Browser performs a trail comparison of this value and the host name to which a request is sent.
Path options is another way to control cookie. This comparison is done by comparing the option value character-by-character against the start of the request URL. If the characters match, then the Cookie header is sent.
If secure option is specified then cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol.