Re: COOKIE EXPIRATION TIME

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Scott M. (s-mar_at_nospam.nospam)
Date: 08/03/04 

Date: Tue, 3 Aug 2004 03:11:21 -0400

The definition you gave is correct, you do specify a time that the cookie
will expires on the client. You just don't set it absolutely that's all.
30 days from today produces a time just as well as 12/31/05 does.

The code I gave you comes directly from the MSDN help on the Expires
property of the HttpCookie class.

Sliding expirations have always been the way cookies have worked. Imagine
setting an absolute date/time and having a new user come to the page 5
seconds before that time!

"Oleg Leikin" <OlegLeikin@discussions.microsoft.com> wrote in message
news:5357891E-C967-4AA0-939D-73D8CECDF145@microsoft.com...
> Scott,
>
> I'm still curious who's right: you or MS documentation :-) The
documentation for HttpCookie.Expires Property says "The time of day (on the
client) at which the cookie expires." - sounds like an absolute value...
> On other hand maybe some lower .NET level translates this absolute value
to time span (but still it should know the local time) or the browser does
the translation ? Or maybe according to the cookie standard this value is
always relative ?
>
> Oleg
>
>
>
> "Scott M." wrote:
>
> > If you intend to read/write cookies from the server-side, then this is
the
> > price you pay. You certainly can do it client-side or capture the local
> > time client-side and send it to the server as a hidden form field.
Either
> > way, cookie expirations are not set absolutely, they are set based on a
> > timespan.
> >
> >
> >
> >
> > "Oleg Leikin" <OlegLeikin@discussions.microsoft.com> wrote in message
> > news:D0E6C1E0-CD5E-4A75-86A3-62E2BCDDBE83@microsoft.com...
> > > Thanks Scott, I'm familiar with the syntax, but suppose that your
server
> > runs at US and the client at Siberia, so when the cookie will reach the
> > recipient his browser will simply discard it.
> > >
> > > Oleg
> > >
> > > "Scott M." wrote:
> > >
> > > > Here you go Oleg:
> > > >
> > > > Example
> > > > The following example sets the expiration time of the cookie to 10
> > minutes
> > > > from the current time.
> > > >
> > > > [Visual Basic]
> > > > Dim dt As DateTime = DateTime.Now()
> > > > Dim ts As New TimeSpan(0,0,10,0)
> > > >
> > > >
> > > > "Oleg Leikin" <OlegLeikin@discussions.microsoft.com> wrote in
message
> > > > news:8A4B3D48-79FF-4EB5-A0B5-3AD595F29572@microsoft.com...
> > > > > Actually my application involves Java Applet tah's embedded at one
of
> > > > ASPXs, so it could supply the local time... But I'm still wondering
how
> > > > other people handle this issue without java script.
> > > > >
> > > > > Oleg
> > > > >
> > > > >
> > > > > "S. Justin Gengo" wrote:
> > > > >
> > > > > > Yes,
> > > > > >
> > > > > > If you're able to get a value back from the client you could
trust
> > that
> > > > you
> > > > > > would know exactly when the cookie would expire.
> > > > > >
> > > > > > Of course this solution counts on the client having javascript
> > enabled.
> > > > > >
> > > > > > --
> > > > > > Sincerely,
> > > > > >
> > > > > > S. Justin Gengo, MCP
> > > > > > Web Developer / Programmer
> > > > > >
> > > > > > www.aboutfortunate.com
> > > > > >
> > > > > > "Out of chaos comes order."
> > > > > > Nietzsche
> > > > > > "Oleg Leikin" <OlegLeikin@discussions.microsoft.com> wrote in
> > message
> > > > > > news:EA3E650B-DED0-41B4-991D-F7902B8591DB@microsoft.com...
> > > > > > > Justin,
> > > > > > >
> > > > > > > do u mean that cookie expiration time is an absolute value ?
> > > > > > >
> > > > > > > Oleg
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > "S. Justin Gengo" wrote:
> > > > > > >
> > > > > > > > Oleg,
> > > > > > > >
> > > > > > > > You could use a javascript to enter the client's time into a
> > hidden
> > > > form
> > > > > > > > field.
> > > > > > > >
> > > > > > > > Of course this information would then have to be posted back
> > before
> > > > > > setting
> > > > > > > > the cookie...
> > > > > > > >
> > > > > > > > Something like this:
> > > > > > > >
> > > > > > > > <script language="Javascript">
> > > > > > > > <!--
> > > > > > > > document.Form1.myHiddenField.value = new Date()
> > > > > > > > //-->
> > > > > > > > </script>
> > > > > > > >
> > > > > > > > --
> > > > > > > > Sincerely,
> > > > > > > >
> > > > > > > > S. Justin Gengo, MCP
> > > > > > > > Web Developer / Programmer
> > > > > > > >
> > > > > > > > www.aboutfortunate.com
> > > > > > > >
> > > > > > > > "Out of chaos comes order."
> > > > > > > > Nietzsche
> > > > > > > > "Oleg Leikin" <OlegLeikin@discussions.microsoft.com> wrote
in
> > > > message
> > > > > > > > news:91CA0EFD-CE4E-44A8-BCDA-0862EF59BC62@microsoft.com...
> > > > > > > > > Hi,
> > > > > > > > >
> > > > > > > > > (newbie question)
> > > > > > > > >
> > > > > > > > > I've created some simple .NET ASP application that should
> > store
> > > > > > cookies at
> > > > > > > > the client machine.
> > > > > > > > >
> > > > > > > > > According to the documentation cookie expiration time is
set
> > via
> > > > > > > > HttpCookie.Expires property, but property value is the time
of
> > day
> > > > on
> > > > > > the
> > > > > > > > client.
> > > > > > > > >
> > > > > > > > > How can I possibly know client local time ?
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Thanks in advance !!!
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > >
> > > >
> > > >
> >
> >
> >

Relevant Pages

  • Re: authentication ticket expiring too soon
    ... it's in history. ... The cookie is deleted by the client. ... Expires must be MM/DD/2007 or something like that... ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Client not returning server cookie
    ... During my server's communication with client, I add a cookie to the ... I saw that in the HTTP response from my server, ... Does that mean that the way I set the Expires ...
    (microsoft.public.dotnet.framework)
  • Re: If not readdir() then what?
    ... Please go read the NFS spec. ... The only thing an NFS client has in order ... filehandle and a cookie as its arguments. ... The server is expected to return cookies for _each_ ...
    (Linux-Kernel)
  • Re: Best authentication methods for CGI <- PERL -> DBI
    ... Right now one method which seems to be really unsecured, is to take them, check them against the PW/ID stored in the database and permit/deny against that. ... The client javascript code takes the password and MD5 sums it, and sends that as the password along with the cleartext username. ... One cookie is the record id of the user in the database, ... A solution to not use https would be public key encryption. ...
    (perl.dbi.users)
  • Re: Best authentication methods for CGI <- PERL -> DBI
    ... Right now one method which seems to be really unsecured, is to take them, check them against the PW/ID stored in the database and permit/deny against that. ... The client javascript code takes the password and MD5 sums it, and sends that as the password along with the cleartext username. ... One cookie is the record id of the user in the database, ... A solution to not use https would be public key encryption. ...
    (perl.dbi.users)