# Persistent Cookies **URL:** \ **Category:** Web\ **Created:** [February 22, 2023, 11:58am UTC](https://forum.xojo.com/t/persistent-cookies/74582 "2023-02-22T11:58:44Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 22, 2023, 11:58am UTC](https://forum.xojo.com/t/persistent-cookies/74582/1 "2023-02-22T11:58:44Z")
For what I could observe, Xojo Web Sessions aren’t real Sessions, I mean, Users Sessions. They are more like “Current connection Session”; connection drops (like closing the laptop lid and moving to another room), connections rises, zap, the “session” is gone, another one is created, and your app, variables, etc are gone too. I’m not aware of other system having such behavior… I really dislike it. That said, this behavior lead me to another problem: Cookies. All I found about cookies in Xojo web is tied to this “connection session”, and they seem ephemeral as I could understand from docs. Connection breaks,connection timeout occurs, all your app cookies are gone with it. Cookies are made to store persistent data for your app, you store it with limited time set and for a “path”, an authorization for a segment of your app, and retrieve it at any time, between sessions, after server reboots, etc since that cookie lifetime is still valid. I can’t see an App.Cookies, something proper to use Cookies as they are intended, in Xojo Web. Am I missing something? I need to read some startup cookies shared by multiple connections to control real user sessions. ---
**Author:** ![Jeremie\_L](https://forum.xojo.com/user_avatar/forum.xojo.com/jeremie_l/32/150_2.png) [@Jeremie\_L](https://forum.xojo.com/u/Jeremie_L)\ **Post date:** [February 22, 2023, 12:16pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/2 "2023-02-22T12:16:13Z")
I believe the issue you are facing is because you do not set an expiration date for the cookies. > If you don’t provide an expiration date, your cookie will expire when the session ends. If you do provide an expiration date, the cookie will expire as late as the provided expiration date because browsers can decide to discard cookies before they expire. > [WebCookieManager — Xojo documentation](https://documentation.xojo.com/api/web/webcookiemanager.html#webcookiemanager-set) I have a WebApp where I set a unique user\_uuid and store it in a Cookie. When the users comes back to the WebApp (through another session), the user\_uuid is correctly retrieved. ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 22, 2023, 12:21pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/3 "2023-02-22T12:21:11Z")
My problem is based on how poor the docs are in the intro. They made it look like it was impossible. There was no mention to expiration or whatever. [https://documentation.xojo.com/topics/application\_structure/web/introduction.html#getting-started-application-structure-web-introduction-cookies](https://documentation.xojo.com/topics/application_structure/web/introduction.html#getting-started-application-structure-web-introduction-cookies) Thank you. Knowing that someone made it already is a great plus. ---
**Author:** ![Jeremie\_L](https://forum.xojo.com/user_avatar/forum.xojo.com/jeremie_l/32/150_2.png) [@Jeremie\_L](https://forum.xojo.com/u/Jeremie_L)\ **Post date:** [February 22, 2023, 12:24pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/4 "2023-02-22T12:24:44Z")
> [@Rick\_Araujo](#): > > My problem is based on how poor the docs are in the intro. They made it look like it was impossible. Agreed. [https://tracker.xojo.com/xojoinc/xojo/-/issues/71874](https://tracker.xojo.com/xojoinc/xojo/-/issues/71874) ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 22, 2023, 12:28pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/5 "2023-02-22T12:28:36Z")
Sadly, it’s private. ![image](https://forum.xojo.com/uploads/default/original/2X/b/b10a237145ef5864cea0bfb6dac66feb6f270906.png) ---
**Author:** ![Jeremie\_L](https://forum.xojo.com/user_avatar/forum.xojo.com/jeremie_l/32/150_2.png) [@Jeremie\_L](https://forum.xojo.com/u/Jeremie_L)\ **Post date:** [February 22, 2023, 12:33pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/6 "2023-02-22T12:33:56Z")
Sorry, I made it private. Didn’t mean too. ![Screenshot 2023-02-22 at 13.32.39](https://forum.xojo.com/uploads/default/original/2X/8/8756a52b086a1ed3a7fd22e1d2c3eb534932b5c0.jpeg) ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 22, 2023, 2:05pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/7 "2023-02-22T14:05:41Z")
They should use more hyperlinks at key places too as: * * * _This is how you set an ephemeral cookie (vanishes with the session) value:_ Session.Cookies.[Set](https://documentation.xojo.com/api/web/webcookiemanager.html#webcookiemanager-set)(“UserName”, “BobRoberts”) _You can set persistent cookies adding a future expiration time as (Retain it for 1 month and 6 hours):_ Session.Cookies.[Set](https://documentation.xojo.com/api/web/webcookiemanager.html#webcookiemanager-set)(“UserName”, “BobRoberts”, DateTime.Now.[AddInterval](https://documentation.xojo.com/api/data_types/datetime.html#datetime-addinterval)(0,1,0,6)) … ---
**Author:** ![Eric\_Bloom](https://forum.xojo.com/user_avatar/forum.xojo.com/eric_bloom/32/716_2.png) [@Eric\_Bloom](https://forum.xojo.com/u/Eric_Bloom)\ **Post date:** [February 22, 2023, 3:33pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/8 "2023-02-22T15:33:52Z")
I also had trouble with cookies - they disappeared after the session closed. Two potential issues not mentioned above: 1. Don’t reference Session.Cookies from any event procedure or method in the Session. Better to put this in a module somewhere else. 2. If your website is secure, you need to secure the cookie. But this won’t work while debugging. I use this: ```auto #if DebugBuild Session.Cookies.Set(CookieName, CookieValue, ExpDateTime) #else Session.Cookies.Set(CookieName, CookieValue, ExpDateTime, "", "", True) ' this sets secure mode cookie #endif ``` ---
**Author:** ![Tim\_Parnell](https://forum.xojo.com/user_avatar/forum.xojo.com/tim_parnell/32/161_2.png) [@Tim\_Parnell](https://forum.xojo.com/u/Tim_Parnell)\ **Post date:** [February 22, 2023, 3:51pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/9 "2023-02-22T15:51:36Z")
Could you please elaborate on item #1? I don’t know of any issues off the top of my head but would like to be informed. As for #2: ```auto Session.Cookies.Set(CookieName, CookieValue, ExpDateTime, "", "", Session.Secure) ``` [Information on Session.Secure](https://documentation.xojo.com/api/web/websession.html#websession-secure) ---
**Author:** ![Geoff\_Perlman](https://forum.xojo.com/user_avatar/forum.xojo.com/geoff_perlman/32/48_2.png) [@Geoff\_Perlman](https://forum.xojo.com/u/Geoff_Perlman)\ **Post date:** [February 22, 2023, 4:52pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/10 "2023-02-22T16:52:28Z")
I’ve updated the documentation to explain this but we have branched so it will appear in the 2023r1 docs. ---
**Author:** ![Eric\_Bloom](https://forum.xojo.com/user_avatar/forum.xojo.com/eric_bloom/32/716_2.png) [@Eric\_Bloom](https://forum.xojo.com/u/Eric_Bloom)\ **Post date:** [February 23, 2023, 11:19am UTC](https://forum.xojo.com/t/persistent-cookies/74582/11 "2023-02-23T11:19:14Z")
re: Don’t reference Session.Cookies from any event procedure or method in the Session From an old post here: [Cookies not readable in Session Open](https://forum.xojo.com/t/cookies-not-readable-in-session-open/53048) Current documentation link: [WebSession — Xojo documentation](https://documentation.xojo.com/api/web/websession.html#notes) Thanks for mentioning `Session.Secure`, I didn’t know about that one. ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 23, 2023, 11:52am UTC](https://forum.xojo.com/t/persistent-cookies/74582/12 "2023-02-23T11:52:13Z")
> [@Eric\_Bloom](#): > > Don’t reference Session.Cookies from any event procedure or method in the Session > From an old post here: [Cookies not readable in Session Open](https://forum.xojo.com/t/cookies-not-readable-in-session-open/53048) In my initial tests, reading a Persistent Cookie seems working just ok in a Session.Opening event. Logically an Ephemeral one wouldn’t, as it vanishes to start a new session. ---
**Author:** ![Eric\_Bloom](https://forum.xojo.com/user_avatar/forum.xojo.com/eric_bloom/32/716_2.png) [@Eric\_Bloom](https://forum.xojo.com/u/Eric_Bloom)\ **Post date:** [February 23, 2023, 3:49pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/13 "2023-02-23T15:49:02Z")
I agree it should work from Session.Opening if you use `Self.Cookies` and not `Session.Cookies`. But I haven’t confirmed this. What I found strange was if I used `Session.Cookies` I was unable to read cookies. No error, just returned an empty string. ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 23, 2023, 4:54pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/14 "2023-02-23T16:54:40Z")
> [@Eric\_Bloom](#): > > I agree it should work from Session.Opening > [@Eric\_Bloom](#): > > But I haven’t confirmed this. I had. At least in a tiny test sample. > [@Eric\_Bloom](#): > > use `Self.Cookies` and not `Session.Cookies` I have a strong feeling that both, in a Session event context, are the same Websession.Cookies, unless in a bugged Xojo Web of the past they diverged. ---
**Author:** ![Tim\_Parnell](https://forum.xojo.com/user_avatar/forum.xojo.com/tim_parnell/32/161_2.png) [@Tim\_Parnell](https://forum.xojo.com/u/Tim_Parnell)\ **Post date:** [February 23, 2023, 5:01pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/15 "2023-02-23T17:01:56Z")
Is this relevant to the issue? > To refer to the current Session from within the Session object, use [Self](https://documentation.xojo.com/api/language/self_keyword.html) instead of Session as the prefix, especially in the Opening event because it may return Nil. [https://documentation.xojo.com/api/web/session.html#session](https://documentation.xojo.com/api/web/session.html#session) ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 23, 2023, 5:17pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/16 "2023-02-23T17:17:46Z")
That deserves a technical explanation. Having a “random” behavior usually is not an acceptable pattern. It seems a documented bug. **In a EventY() of an ObjectX, self should always be ObjectX**. Looks like ObjectZ is calling ObjectX.EventY(self = ObjectZ) ? Who is ObjectZ? And when ObjectZ appears, who is ObjectX (that should be the real self, Session in this context)? Looks like some kind of bugged mix of Self and Sender? Please @Ricardo_Cruz , if you can explain if this still occurs nowadays, not a bug from the past, the **WHY** must be documented, and acceptable. If my object has a property mmm=1, showing mmm or self.mmm should show 1 always. ---
**Author:** ![Rick\_Araujo](https://forum.xojo.com/user_avatar/forum.xojo.com/rick_araujo/32/251_2.png) [@Rick\_Araujo](https://forum.xojo.com/u/Rick_Araujo)\ **Post date:** [February 23, 2023, 8:33pm UTC](https://forum.xojo.com/t/persistent-cookies/74582/17 "2023-02-23T20:33:39Z")
I tried to find a difference, but in all my trials, using the Session.Opening, Session.Identifier and Self.Identifier matched. I couldn’t replicate the bug pointed in the docs. Was it fixed? What I noticed is that Xojo does some jugglery with syntactic sugaring, and Session, at the root level, seems a module, and the real Session object is really Session.Session, and maybe in the past they made things confuse while spraying that sugar and just thrown some lines in the docs while trying to fix it? ---
**Author:** ![DerkJ](https://forum.xojo.com/letter_avatar_proxy/v4/letter/d/e495f1/32.png) [@DerkJ](https://forum.xojo.com/u/DerkJ)\ **Post date:** [February 24, 2023, 8:05am UTC](https://forum.xojo.com/t/persistent-cookies/74582/18 "2023-02-24T08:05:17Z")
i think Session() is a method as well as a Class. That’s probably why you need Self. I’m not sure under the hood but i think they made it harder than needed. So you need a WebSessionContext while you can also call App.SessionAt(index) causing much confusion. So then there would be too many ways to get a session.