What is the difference between creating cookies on the server and on the client? Are these called server side cookies and client side cookies? Is there a way to create cookies that can only be read on the server or on the client?
5 Answers
What is the difference between creating cookies on the server and on the client?
What you are referring to are the 2 ways in which cookies can be directed to be set on the client, which are:
- By server
- By client ( browser in most cases )
By server:
The Set-cookie response header from the server directs the client to set a cookie on that particular domain. The implementation to actually create and store the cookie lies in the browser. For subsequent requests to the same domain, the browser automatically sets the Cookie request header for each request, thereby letting the server have some state to an otherwise stateless HTTP protocol. The Domain and Path cookie attributes are used by the browser to determine which cookies are to be sent to a server.
The server only receives name=value pairs, and nothing more.
By Client:
One can create a cookie on the browser using document.cookie = cookiename=cookievalue. However, if the server does not intend to respond to any random cookie a user creates, then such a cookie serves no purpose.
Are these called server side cookies and client side cookies?
Cookies always belong to the client. There is no such thing as server side cookie.
Is there a way to create cookies that can only be read on the server or on the client?
Since reading cookie values are upto the server and client, it depends if either one needs to read the cookie at all.
On the client side, by setting the HttpOnly attribute of the cookie, it is possible to prevent scripts ( mostly Javscript ) from reading your cookies , thereby acting as a defence mechanism against Cookie theft through XSS, but sends the cookie to the intended server only.
Therefore, in most of the cases since cookies are used to bring 'state' ( memory of past user events ), creating cookies on client side does not add much value, unless one is aware of the cookies the server uses / responds to.
Reference: Wikipedia
Yes you can create cookies that can only be read on the server-side. These are called "HTTP Only" -cookies, as explained in other answers already
No, there is no way (I know of) to create "cookies" that can be read only on the client-side. Cookies are meant to facilitate client-server communication.
BUT, if you want something LIKE "client-only-cookies" there is a simple answer: Use "Local Storage".
Local Storage is actually syntactically simpler to use than cookies. A good simple summary of cookies vs. local storage can be found at:
A point: You might use cookies created in JavaScript to store GUI-related things you only need on the client-side. BUT the cookie is sent to the server for EVERY request made, it becomes part of the http-request headers thus making the request contain more data and thus slower to send.
If your page has 50 resources like images and css-files and scripts then the cookie is (typically) sent with each request. More on this in Does every web request send the browser cookies?
Local storage does not have those data-transfer related disadvantages, it sends no data. It is great.
Related