document.cookie is still accessible on IE11, even though cookies are disabled

问题

Using IE11, I can display the content of all cookies, write out a cookie, find it, and delete it using JavaScript, even though I have my Privacy set to "Block All Cookies". (And actually, no matter what version I set my IE emulation to, the document.cookie still works.) It works as it should on Chrome with cookies disabled - i.e. document.cookie returns empty/nothing when I try to reference it in the same JavaScript.

I'm trying to detect whether the user has cookies turned off in their IE. (Old ASP app that requires IE with cookies. No JQuery. No Modernizr.) To do that, I'm attempting to write out a cookie, find it, and then delete it. That either works or it doesn't - which should tell me whether cookies are turned ON or OFF. Any ideas? I thought this was the safest way to detect a user's IE cookie setting.

My code:

<script language=javascript>
     cookiesON = false;
     if ("cookie" in document ) {
         alert("1. document.cookie (before add): " + document.cookie);

         var dateNow = new Date();
         document.cookie = "testcookie=" + new Date()
         alert("2. document.cookie (after add): " + document.cookie);

         if (document.cookie.indexOf("testcookie=") > -1) {
            cookiesON  = true;
         } else {
            cookiesON  = false;
         }

         // delete cookie: set cookie to expire 2 minutes ago
         document.cookie="testcookie=xx; expires=" + (new Date(dateNow.getTime() - 2*60000).toGMTString());
         alert("3. document.cookie (after delete): " + document.cookie);
      }

On IE: All 3 alerts show values for document.cookie, no matter whether cookies are turned on or off. You can see the testcookie being added and deleted back off.

On Chrome: All 3 alerts show blank for document.cookie when cookies are off. Works as described for IE when cookies are turned on.

来源：https://stackoverflow.com/questions/30536141/document-cookie-is-still-accessible-on-ie11-even-though-cookies-are-disabled