[midasxl]

I have been experimenting with ColdFusion cookies and how they are treated by FireFox and by Internet Explorer. I noticed a few interesting differences.

Consider the following cookies; they are being set in the application.cfc:

#1 <!--- persistent cookie; will expire in 30 years from the exact time it is created.--->
<cfcookie name="person.fname" value="Mark" expires="never">
#2<!--- expires immediately.  Is never written to client cookie.txt file but stays in memory. --->
<cfcookie name="person.mname" value="Alan" expires="now">
#3<!--- will expire 7 days from the exact time it is created.--->
<cfcookie name="person.lname" value="Riggs" expires="7">
#4<!--- No expiration attribute. Session only cookie.  Will expire on browser close. --->
<cfcookie name="person.nname" value="Sparky">

In Firefox (Tools -> Options -> Privacy -> Show Cookies):

#1 This cookie is stored on my computer and expires in 30 years (Year 2041).

#2 This cookie is not stored on my computer. I imagine because it is set to expire immediately.

#3 This cookie is stored on my computer and expires in 7 days (Feb 10, 2011)

#4 This cookie is stored on my computer and expires at end of session


In IE8 (Tools -> Internet Options -> Browsing History -> Settings -> View Files):

I get a single cookie that looks like this:

PERSON.FNAME
Mark
issrsdev.xxxxx.xxxx.xxx/
1024
3852832896
32333899
3200059040
30131135
*

PERSON.LNAME
Riggs
issrsdev.xxxxx.xxxx.xxx/
1024
3879686272
30132543
3200059040
30131135
*

I'm going to refer to this as a bundled cookie.

#1 This name/value pair is present in the bundled cookie.

#2 This name/value pair is not present in the bundled cookie.

#3 This name/value pair is present in the bundled cookie.

#4 This name/value pair is not present in the bundled cookie.

That's what it looks like to me: a single cookie with all the name/value pairs of all the cookies I created in the application.cfc.

The expiration date on this bundled cookie is 1/26/2041. As you can see above the expiration attribute value for #1 is "never" and the expiration attribute value for #3 is 7 days.

I then set #1 to expire in 4 days and #3 to expire in 7 days, and the cookie then reflects an expiration date 7 days from the time it is created.

So it looks like the cookie is taking the longest expiration date it can find out of the individual cookies and using that for the overall cookie expiration date.

So how do I deal with creating two cookies with drastically different expiration dates, and getting them to behave in IE8?

Thanks for any thoughts or comments on this one!

Peace!

[midasxl]

In addition to the above, I created the same four cookies using the cookie scope instead as follows:

<cfset cookie.fname = "Mark" />
<cfset cookie.mname = "Alan" />
<cfset cookie.lname = "Riggs" />
<cfset cookie.nname = "Sparky" />

This is much more limited than the previous method of cookie creation in that you cannot set the path, domain, or expiration times.

As expected, with no expiration time, the cookies are treated as session-only and do not even show up in IE8 cookie folder.

Firefox brings them in and all four of them are set to expire at end of session.

[Craig328]

Well for your first example, I would guess the problem lies in that you're creating them with a dot notation name. That is, "person.fname", for example. Think on it a moment: if you did the same with a session variable (created a person.fname and a person.lname and tried to store them in the session scope) what would you have? You'd have a struct named "person" with variables contained therein named fname and lname...all stored in the session scope. So it seems like it would be natural to assume that trying to store a complex variable (a struct) in the cookie scope would attempt to do the same thing.

Now, way back in the day, it used to be that cookies could only hold string values and that any attempt to assign a cookie a complex data value would error out. It would seem that this is no longer the case...although because how cookies are created/stored is entirely up to the browser, it would appear that both FF and IE have decided to allow complex data in cookies but do so in different fashions. In fact, I ran across the Adobe example they provide in the online docs that say you can use dot notation in cookies. This is a good example though of how sometimes you need to check things out yourself as the documentation can sometimes be incomplete or incorrect. In this case, while they say you CAN do this, they kinda neglect to mention that different browsers will handle this differently...which pretty much neuters any actual use of the practice (storing complex data user side in a cookie). Like, for instance, you tested FF and IE...but there's still a whole host of browsers (and OS) left over and no decent publicly accessible app wants to rely on something that may not behave the same on all machines accessing the app.

[Craig328]

In fact, now that I think on it, you may want to do some more digging and if you find inconsistent behavior amongst other browser/OS combos, you might want to consider posting a note on Adobe's own docs for CFCOOKIE.

Pete Freitag has a note there and he's a pretty big hitter in the CF world. I'd guess that because nobody's bothered to post this discover on the Adobe site for CFCOOKIE that maybe (just maybe) you were the first guy to discover this. If you're interested, do a little more experimenting, document your results and if they bear out, consider posting the results on the Adobe page and then maybe drop someone like Pete or Ben Nadel or Ray Camden a note (try searching their blogs first to see if they're already aware) and see what they know/think.

People use CF for all kinds of things and while maybe you or I wouldn't have much day to day use for cookies with complex data stored therein, someone else might...even if it's done inconsistently across different user environments.

[midasxl]

Craig328, on 04 February 2011 - 06:59 AM, said:

Well for your first example, I would guess the problem lies in that you're creating them with a dot notation name. That is, "person.fname", for example. Think on it a moment: if you did the same with a session variable (created a person.fname and a person.lname and tried to store them in the session scope) what would you have? You'd have a struct named "person" with variables contained therein named fname and lname...all stored in the session scope. So it seems like it would be natural to assume that trying to store a complex variable (a struct) in the cookie scope would attempt to do the same thing.

Great point; didn't think about the dot notation aspect of the cookie creation. I modified the code to set cookies in this manner:

<cfcookie name="fname" value="Mark" expires="never">
<cfcookie name="lname" value="Riggs" expires="7">

Running the page and checking the cookies in IE gives me the same results as the dot notation cookie creation. There is a single cookie.txt file with an expiration date of Jan. 27, 2041. Even though the LNAME cookie within is set to expire in 7 days.

FNAME
Mark
xxx.xxx.xxx.xxx/
1024
1359373696
32334099
705869840
30131335
*
LNAME
Riggs
xxx.xxx.xxx.xxx/
1024
1386227072
30132743
706029840
30131335
*

Firefox brings the two cookies in and lists them separately with independent expiration dates. I am going to experiment some more as you suggested and use other browsers beyond IE and FF and document the experience. Thanks!