更新时间:2023-11-27 21:52:28
使用; expires 追加是一个坏主意,因为你想要销毁内容。
一个更好的想法是通过将值设置为垃圾为空,并且还包含 expires
字段:
Set-Cookie:token = deleted; path = /; expires = Thu,01 Jan 1970 00:00:00 GMT
请注意,您无法强制所有浏览器删除cookie。客户端可以配置浏览器,使cookie保持不变,即使它已过期。如上所述设置值将解决这个问题。
For my authentication process I use py-bcrypt to create a unique token when a user logs in and put that into a cookie which is used for authentication.
So I would send something like this from the server:
Set-Cookie: token=$2a$12$T94df7ArHkpkX7RGYndcq.fKU.oRlkVLOkCBNrMilaSWnTcWtCfJC; path=/;
Which works on all browsers. Then to delete a cookie I send a similar cookie with the expires
field set for January 1st 1970
Set-Cookie: token=$2a$12$T94df7ArHkpkX7RGYndcq.fKU.oRlkVLOkCBNrMilaSWnTcWtCfJC; path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;
And that works fine on Firefox but doesn't delete the cookie on IE or Safari.
So what is the best way to delete a cookie (without JavaScript preferably)? The set-the-expires-in-the-past method seems bulky. And also why does this work in FF but not in IE or Safari?
Sending the same cookie value with ; expires
appended is a bad idea since you want the contents to be destroyed.
A better idea would be invalidating the cookie by setting the value to rubbish empty and include an expires
field as well:
Set-Cookie: token=deleted; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Note that you cannot force all browsers to delete a cookie. The client can configure the browser in such a way that the cookie persists, even if it's expired. Setting the value as described above would solve this problem.