Reading Cookie Values

When you use the cookie property in a JavaScript expression, the value it returns is a string containing all the cookies that apply to the current document. The string is a list of name=value pairs separated by semicolons, where name is the name of a cookie, and value is its string value. You can use the String.indexOf() and String.substring() methods to determine the value of the named cookie you are interested in.

Once you have obtained the value of a cookie in this way, you must interpret that value based on whatever format or encoding was used by the creator of that cookie. For example, the cookie might store multiple pieces of information in colon-separated fields. In this case, you would have to use appropriate string methods to extract the various fields of information.

The value of a cookie must not contain any semicolons, commas, or whitespace. Because these are commonly used characters, it is common to use the JavaScript escape() function to encode cookie values before storing them, and the unescape() function to decode the values after retrieving them.

Note that the Document.cookie field provides no way to obtain the domain, path, expiration, or secure fields associated with a cookie.

Storing Cookies

To associate a temporary cookie value with the current document, simply set document.cookie to a string of the form name=value. The next time you read document.cookie, the name and value pair will be included in the list of cookies for the document. As noted above, the cookie value may not include semicolons, commas or whitespace. For this reason, you may want to use the JavaScript escape() function to encode the value before storing it in the cookie.

A cookie written as described above will last for the current web browsing session, but will be lost when the user exits the browser. To create a cookie that can last across browser sessions, include an expiration date. You can do this by setting document.cookie to a string of the form:

name=value; expires=date

date should be a date specification in the format written by Date.toGMTString().

Similarly, you can set the path, domain, and secure fields of a cookie by appending strings of the following form to the cookie value before that value is written to the document.cookie property. (See http://home.netscape.com/newsref/std/ cookie_spec.html for more information about the meaning of the path, domain, and secure fields of a cookie.)

; path=path
; domain=domain
; secure

To change the value of a cookie, set its value again, using the same name (and the same path and domain, if any) and the new value.

To delete a cookie, set it again using the same name, path and domain, an arbitrary value, and an expiration date that has already passed. Note that the browser is not required to immediately delete expired cookies. In practice, with Netscape Navigator, cookie deletion seems to work more effectively if the expiration date is in the relatively distant (several hours or more) past.