cookies 設定

cookies api
# :value - The cookie‘s value or list of values (as an array).
# :path - The path for which this cookie applies. Defaults to the root of the application.
# :domain - The domain for which this cookie applies.
# :expires - The time at which this cookie expires, as a Time object.
# :secure - Whether this cookie is a only transmitted to HTTPS servers. Default is false.
# :http_only - Whether this cookie is accessible via scripting or only HTTP. Defaults to false.

cookies 的一些觀念
1.要在這個domain 跟 path之下的才能拿, 例如如果把domain設成
ilake.demo.com, demo.demo.com 這樣彼此是不能拿的, 可是設成 demo.com 便可以

2. cookies 誰都可以寫, 寫就是寫了, https 寫的 http 也可以拿, 但是可以設成只有 https 才可以拿, :secure 就是此選項, 而http_only 便是javascript 不能拿

3.不能把cookie domain 設成你現在server domain 以外的 domain

4.navigator.cookieEnabled 可以檢查cookie 功能是否開啟

5.cookie 不能包含分號 逗號 空白, 所以有時妳會需要用encodeURIComponent, 讀取時就要使用相對應的decodeURIComponent

6.刪除cookie, 就是把他直接設過去的時間即可

7.cookie 只能有4K, cookie 在妳request 其符合規則網頁時(same domain, path etc...)
就算妳沒用它, 它也會上傳到server

---

另外 rails cookies 裡有 subdomain_fu 在localhost 這種 domain 之下, 有點問題, 把他弄成demo.com 這樣正常的domain, 便可以正常拿到該domain 下的cookies

cookie_store,session

http://railscasts.com/episodes/84-cookie-based-session-store
http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/
http://blog.caboo.se/articles/2007/2/21/new-controversial-default-rails-session-storage-cookies
http://stackoverflow.com/questions/192153/what-is-the-best-way-to-read-the-rails-session-secret
http://hi.baidu.com/holin/blog/item/36b9b21127f85e7ccb80c45e.html
http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000299

actionpack-2.1.2/lib/action_controller/session/cookie_store.rb
<br /> # Generate the HMAC keyed message digest. Uses SHA1 by default.<br /> def generate_digest(data)<br /> key = @secret.respond_to?(:call) ? @secret.call(@session) : @secret<br /> OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(@digest), key, data)<br /> end<br /><br /> private<br /> # Marshal a session hash into safe cookie data. Include an integrity hash.<br /> def marshal(session)<br /> data = ActiveSupport::Base64.encode64(Marshal.dump(session)).chop<br /> "#{data}--#{generate_digest(data)}"<br /> end<br /><br /> # Unmarshal cookie data to a hash and verify its integrity.<br /> def unmarshal(cookie)<br /> if cookie<br /> data, digest = cookie.split('--')<br /><br /> # Do two checks to transparently support old double-escaped data.<br /> unless digest == generate_digest(data) || digest == generate_digest(data = CGI.unescape(data))<br /> delete<br /> raise TamperedWithCookie<br /> end<br /><br /> Marshal.load(ActiveSupport::Base64.decode64(data))<br /> end<br /> end<br /><br />

BAh7ByIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%0ASGF
zaHsABjoKQHVzZWR7ADoNbG9naW5faWQw--b410e484d58fa0b31c5e778115c66ea29a220af8

-- 前面是data的部份, 後面是digest的部份, data可以讓user 去decode 沒關係, 但是digest的部份有加上secret 去做encode, 所以可以用來辨識這是不是我們網站自己產生合法的cookie