JavaScript Duplicate Cookies

问题

I'm using the Hapi framework for a Node.js application, and the Hapi framework comes with its own Cookie management tools, which i'm using for authentication.

The framework then sets a cookie named session, with a json value encoded to base64. The domain is set to example.com (not .example.com)

Now, the problem lies when i attempt to edit this cookie client-side, by doing the following

document.cookie = 'session=' + btoa(JSON.stringify(_decoded)) + "; path=/; domain=example.com";

This actually sets a duplicate cookie with the domain '.example.com'

I haven't asked Javascript to prepend the dot, and i cant seem to get rid of it.

I'm assuming that it is because of this dot, that the cookie is being duplicated. How do i set the domain without it automatically prepending a dot?

EDIT

I've given up on trying to remove the leading dot, and instead am trying to delete the old cookie and then create a new one. However i still end up with duplicate cookies!

Navigate to /login and enter login details
Redirected to /account and cookie set by server (WITHOUT Leading Dot)
Execute Javascript to delete and re-create cookie
1 cookie now exists and it has a Leading Dot before the domain

The above behaviour is good, however the following also happens, which is bad

Navigate to /login and enter login details
Redirected to /account and cookie set by server (WITHOUT Leading Dot)
Navigate to /example
Execute Javascript to delete and re-create cookie
2 cookies now exists, one with the leading dot(created by JS) and one without (created by server)

The code i'm using is

API.Session = {
    Encoded : function () { return document.cookie.replace(/(?:(?:^|.*;\s*)session\s*\=\s*([^;]*).*$)|^.*$/, "$1")},
    Decoded : function () { return JSON.parse(atob(this.Encoded()))},
    Update : function (_decoded) { 
        document.cookie = 'session=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
        document.cookie = 'session=' + btoa(JSON.stringify(_decoded)) + "; path=/; domain=example.com;";      
    }
}

API.Helpers.ShowAdvancedOptions = function () {
    var s = API.Session.Decoded()
    s.ShowAdvancedOptions = true
    API.Session.Update(s)
}

回答1:

Is by some chance the original cookie already present in this?

btoa(JSON.stringify(_decoded))

Cause from: document.cookie

document.cookie is defined as:

a string containing a semicolon-separated list of all cookies

So it seems to me you are adding a new semicolon-separated value (new cookie) to that list (without removing the original cookie)

Ok, it's not that, have you tried this?

link

Sounds like the same problem you described

回答2:

For anyone with a similar issue, this was eventually solved by dropping the domain property altogether. See other related question

来源：https://stackoverflow.com/questions/46025255/javascript-duplicate-cookies

标签

javascript

duplicates

frontend

session-cookies