http - How browser correctly calculate epiration datetime of cookie with different timezone on server and client side -
the server , client in different time zone. difference in 6 hours. server sets cookie 1 hour client correctly receives , keeps hour, although client 5 hours ago. how client correctly sets cookie on hour? browser looks @ header "date"? if so, if server behind proxy server, set own "date" header?
must provide proof reference rfc or where.
there 2 ways specify maximum age cookie:
- expires attribute: http://tools.ietf.org/html/rfc6265#section-5.2.1
- max-age attribute: http://tools.ietf.org/html/rfc6265#section-5.2.2
max-age relative time of setting.. texpiration = tsetting + max-age
otherwise, expires attribute sets date / time value including timezone: http://tools.ietf.org/html/rfc6265#section-5.1.1
example rfc itself:
expires=wed, 09 jun 2021 10:18:14 gmt
there many standards (old , new) favor gmt (utc) date / time format:
- https://tools.ietf.org/html/rfc7231#section-7.1.1.1
- https://www.w3.org/protocols/rfc2616/rfc2616-sec3.html
from rfc2616 got called http format:
all http date/time stamps must represented in greenwich mean time (gmt), without exception. purposes of http, gmt equal utc (coordinated universal time).
the expires attribute should set time in http format:
e.g. set-cookie: reg_fb_gate=deleted; expires=thu, 01-jan-1970 00:00:01 gmt; path=/; domain=.example.com; httponly
(from wikipedia)
Comments
Post a Comment