Hacker News Reader

Comment by kevincox | Hacker News Reader

But if the attributes are exactly the same then the cookies replace each other. So this isn't a general mechanism for representing a list.

Not to mention that the way to delete a cookie is sending a replacement cookie that expires in the past. How are you supposed to delete the right cookie here?

View on HN

And the worst is that you need to exactly match the domain and path semantics in order to delete the cookie! Domain is easy enough because there are only two options - available to subdomain and not available to subdomain. But if you have a cookie with the `/path` set and you don't know what value was used, you literally cannot delete that cookie from JS or the backend. You need to either pop open devtools and look at the path or ask the end user to clear all cookies.

Is there a way for JS to see the attributes for each value? Because presumably setting an expire time in the past and iterating over every used set of attributes would get the job done to delete the cookie. Iterating over all possible (plausible?) attributes may also work, but knowing the specific attributes set would narrow that list of erasing writes to issue.

No, there isn't. All you get a list of values that are valid for the current page. Same on the server side.

If you're ever in a situation where you need to invalidate all possible instances of a cookie, it's easier to just use a different name.

Reply on news.ycombinator.com