I access multiple Xojo web apps from my one computer (macOS). If I set a cookie in one Xojo Web app to represent a UUID eg Session.Cookies.Set("UUID", "ABC123", YearFromNowDate)
then the cookie is set properly and is accessible for each Xojo web app using: UUID = Session.Cookies.Value("UUID")
If I remove the Cookie in one of the other Xojo web apps ie Session.Cookies.Remove("UUID")
then the Cookie appears blank if I immediately try to retrieve it.
BUT if I log out of my Session and reconnect the removed UUID Cookie is back with the previous value! Is this correct?
Can a Cookie only be Removed by its originating Xojo Web App? How can I set and/or remove a Cookie that is cross-Xojo Web App compatible?
This may be a Xojo bug, but it could also be browser-specific. I just read this article April King — Handling Cookies is a Minefield which discusses all the weird edge cases in cookie handling.
Finally, to remove a cookie, the server returns a Set-Cookie header with an expiration date in the past. The server will be successful in removing the cookie only if the Path and the Domain attribute in the Set-Cookie header match the values used when the cookie was created.
I wonder if Xojo is doing this properly?
If not, you can probably work around it yourself:
don’t call Cookies.Remove()
instead call Cookies.Set() with a bogus value, and an expiration date in the past.
Your Xojo web apps are running on your computer?
If not, are all running on the same domain?
If not and they are running on different domains, do you want to delete a cookie for domainA from domainB?
Thanks for the web link, it helped me understand what Domain and Path mean and I think I can leave them blank.
As per your advice, I have tried instead to set the Expiry date on the Cookie to be in the past, then delete it, but it still remains with the future date. Here is the code:
Var YearBeforeNowDate As DateTime = DateTime.Now.SubtractInterval(1) 'expire 1 year ago
Session.Cookies.Set(CookieName.Text, CookieValue.Text, YearBeforeNowDate)
Session.Cookies.Remove(CookieName.Text)
At the moment I have finished a Web App and am testing it before deployment on my host, so currently it is all on my one macOS computer ie 127.0.0.1. I keep aside a fake UUID cookie, plus the last UserID and ServerID to allow them to sign in via their password alone without having to fully sign in each time.
What was shocking was that the cookie values that return for these CookieNames were for another Xojo Web App, and I have been unable to remove them, nor get my new cookies to stick around after my Session ends.
I’m quite certain that setting the domain to an empty string won’t be a supported condition, regardless of your actions. All the information I’ve come across indicates that it’s a mandatory parameter, and any results without it will be unpredictable.
However, if all the apps share a domain, you shouldn’t encounter any issues. Just make sure to exclude the subdomain.
I think the reason I couldn’t remove the old Cookies is that I have asked Safari to stop third party tracking, so it seems to sandbox my new cookies to only last for that session and after that be discarded, plus stop me from removing/editing old cookies.
I will be using my domain from now on, but leaving the path blank.
Also, there are some recent changes in Safari that makes testing these things difficult when working with cookies using the localhost / 127.0.0.1 hosts. Testing it on a real domain with HTTPS sometimes helps.