Cookies.  Cookies are small bits of information, such as strings and numeric values, stored in the client's computer for a short period of time.  When they are stored on the client's computer the developer needs to specify when they should expire.

Here are some possible applications for the use of cookies.

• Consider our session duration login procedure developed in the last web page.  Maybe you run an on-line magazine and people pay for a yearly subscription.  You want their login information to be stored on their computer so that every time they visit your site they don't have to re-enter their login information.  Obviously there are some downsides to this approach.
• Maybe you have developed a website about music and you have some music classifications on your site.  You have tried to develop your site so that people that prefer particular types of music will have their web experience modified so that their first choices are determined by their past visit classifications.  This implies their primary options relate to their music preferences.  It's not the case that they cannot view other classifications, it's just that they will need to drill down for these other options.  What's up front to them relates to what they've used in the past.

Some Privacy and Security Issues.  There are obviously many other scenarios where maintaining bits of information about the client on the client's computer can be advantageous.  There are also many scenarios where maintaining this information could be invasive of privacy.  These sorts of privacy and security issues still rage around the use of cookies.  For example,

• Maybe the above magazine is an adult magazine and this adult has children that may use the computer.  They can gain automatic access to the magazine.  That is, anyone else using the computer that has stored this login information has automatic access to the information.
• Also considering the on-line magazine, what if the paying customer finds their self wanting to access the magazine while using another computer.  Do you want to assume they remember their login information even though they seldom use it?  Do you want this temporary user to be able to store their login information on the computer they are temporarily using so that others can then gain "free" access to your magazine?
• While all modern browsers accept cookies by default they also provide users with the option to not accept cookies.  How do you deal with users that do not accept cookies?

There are many other issues that concern people about the use of Cookies.  How easy does it make it for others to check out information about the webs you've visited in the past?  Fortunately, some of these issues are ameliorated by the following.

If a web site creates a cookie on the client's computer, only that website can later read the cookie's value.  The ability and responsibility to keep track of which web site created what cookie is supposed to be built into a browser.

Storing Cookies.  There are two major ways to store cookies on a client.  Let's assume you have several basic pieces of information you want to persist.

1. Store each variable separately in a distinct cookie using a different name.
2. Use a key for each variable within a single cookie.

The second approach is probably somewhat cleaner, though not necessarily superior.

If you create a cookie and set it to some value or a single variable and then create keys for that cookie, the cookie's initial value will be erased.  A cookie cannot work using both individual values and keys.  Keys in cookies have precedence over assigning individual values.

Writing Cookies.  It shouldn't surprise you that cookies are written using the Response object.  We will focus on using keys since they are usually the preferred approach.

Let's assume that next time the user visits your web you want to know the date and time of their last visit, their first name and the browser type, version and client operating system.  Let's assume that part of the reason you want a cookie is so that you don't have to repeatedly ask the user for their first name every time they visit your site in order to personalize their visit.  In order to store this information on the client using cookies you will need a segment of code that looks something like the following.  Assume you get their name from some form interaction and have stored it in  Session("FirstName").  

Response.Cookies("UserInfo")("Key1") = Now
Response.Cookies("UserInfo")("Key2") = Session("FirstName")
Response.Cookies("UserInfo")("Key3") = Request.ServerVariables("HTTP_USER_AGENT")

Well, these keys are not particularly mnemonic so we will change the code slightly to be like the following WriteCookies.asp.

Reading Cookies.  But before you can click on the hyperlink you need to enter the code for ReadCookies.asp so that you can view what was written into the cookies.  As you might expect the Request class is used to request info from the cookies.

Setting When Cookies Expire.  One other major thing you probably should learn about cookies is how to set their expiration date and/or time.  You should have already noticed that they expired when you went back to ReadCookies.asp.  So we need to make sure we can set them so they expire when we want them to expire.  This is done by setting the Expires property explicitly.

The following code isn't much different than the code for WriteCookies.asp except that it has an extra statement for setting the cookies expiration.  

Response.Cookies("UserInfo").Expires = #December 24, 2003#

You should be able to set this to just about any date you want using all the different VBScript formatting approaches.  You should call this file ExpireCookies.asp.

Now you also want to try and find the cookies file that you just created on your client computer.  You may want to do a find or search on cookies.* (Netscape) or cookies (Internet Explorer) to see what was written to your cookies.  Remember, cookies usually depend on the browser the client is using.  The following image relates to Netscape cookies.  Unfortunately, much had to be cropped to get it to fit reasonably on the web page.

Finally, the last thing that should be said about setting expiration dates is that if you want to set the date for a certain number of days from the present you need to use a statement like the following.

Response.Cookies("UserInfo").Expires = Date + 90

In order to get the cookie to expire 90 days from now.