From 4b1a9203c547c019fc5398082ae19a3f3d4c3efe Mon Sep 17 00:00:00 2001 From: Peter Bengtsson Date: Tue, 8 Dec 2020 14:41:15 -0500 Subject: initial commit --- files/de/web/http/headers/set-cookie/index.html | 225 +++++++++++++++++++++ .../http/headers/set-cookie/samesite/index.html | 135 +++++++++++++ 2 files changed, 360 insertions(+) create mode 100644 files/de/web/http/headers/set-cookie/index.html create mode 100644 files/de/web/http/headers/set-cookie/samesite/index.html (limited to 'files/de/web/http/headers/set-cookie') diff --git a/files/de/web/http/headers/set-cookie/index.html b/files/de/web/http/headers/set-cookie/index.html new file mode 100644 index 0000000000..917e705959 --- /dev/null +++ b/files/de/web/http/headers/set-cookie/index.html @@ -0,0 +1,225 @@ +--- +title: Set-Cookie +slug: Web/HTTP/Headers/Set-Cookie +tags: + - Cookies + - HTTP + - NeedsTranslation + - Reference + - Response + - TopicStub + - header + - samesite +translation_of: Web/HTTP/Headers/Set-Cookie +--- +
{{HTTPSidebar}}
+ +

The Set-Cookie HTTP response header is used to send a cookie from the server to the user agent, so the user agent can send it back to the server later. To send multiple cookies, multiple Set-Cookie headers should be sent in the same response.

+ +
+

Browsers block frontend JavaScript code from accessing the Set Cookie header, as required by the Fetch spec, which defines Set-Cookie as a forbidden response-header name that must be filtered out from any response exposed to frontend code.

+
+ +

For more information, see the guide on Using HTTP cookies.

+ + + + + + + + + + + + + + + + +
Header type{{Glossary("Response header")}}
{{Glossary("Forbidden header name")}}no
Forbidden response-header nameyes
+ +

Syntax

+ +
Set-Cookie: <cookie-name>=<cookie-value>
+Set-Cookie: <cookie-name>=<cookie-value>; Expires=<date>
+Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>
+Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>
+Set-Cookie: <cookie-name>=<cookie-value>; Path=<path-value>
+Set-Cookie: <cookie-name>=<cookie-value>; Secure
+Set-Cookie: <cookie-name>=<cookie-value>; HttpOnly
+
+Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Strict
+Set-Cookie: <cookie-name>=<cookie-value>; SameSite=Lax
+Set-Cookie: <cookie-name>=<cookie-value>; SameSite=None; Secure
+
+// Multiple attributes are also possible, for example:
+Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>; Secure; HttpOnly
+
+ +

Attributes

+ +
+
<cookie-name>=<cookie-value>
+
A cookie begins with a name-value pair: +
    +
  • A <cookie-name> can be any US-ASCII characters, except control characters, spaces, or tabs. It also must not contain a separator character like the following: ( ) < > @ , ; : \ " / [ ] ? = { }.
    • +
  • A <cookie-value> can optionally be wrapped in double quotes and include any US-ASCII characters excluding control characters, {{glossary("Whitespace")}}, double quotes, comma, semicolon, and backslash. Encoding: Many implementations perform URL encoding on cookie values, however it is not required per the RFC specification. It does help satisfying the requirements about which characters are allowed for <cookie-value> though.
    • +
  • __Secure- prefix: Cookies names starting with __Secure- (dash is part of the prefix) must be set with the secure flag from a secure page (HTTPS).
    • +
  • __Host- prefix: Cookies with names starting with __Host- must be set with the secure flag, must be from a secure page (HTTPS), must not have a domain specified (and therefore aren't sent to subdomains) and the path must be /.
    • +
+
+
Expires=<date> {{optional_inline}}
+
+

The maximum lifetime of the cookie as an HTTP-date timestamp. See {{HTTPHeader("Date")}} for the required formatting.

+ +

If unspecified, the cookie becomes a session cookie. A session finishes when the client shuts down, and session cookies will be removed.

+ +
+

Warning: Many web browsers have a session restore feature that will save all tabs and restore them next time the browser is used. Session cookies will also be restored, as if the browser was never closed.

+
+ +

When an Expires date is set, the deadline is relative to the client the cookie is being set on, not the server.

+
+
Max-Age=<number> {{optional_inline}}
+
Number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If both Expires and Max-Age are set, Max-Age has precedence.
+
Domain=<domain-value> {{optional_inline}}
+
Host to which the cookie will be sent. +
    +
  • If omitted, defaults to the host of the current document URL, not including subdomains.
    • +
  • Contrary to earlier specifications, leading dots in domain names (.example.com) are ignored.
    • +
  • Multiple host/domain values are not allowed, but if a domain is specified, then subdomains are always included.
    • +
+
+
Path=<path-value> {{optional_inline}}
+
A path that must exist in the requested URL, or the browser won't send the Cookie header.
+
The forward slash (/) character is interpreted as a directory separator, and subdirectories will be matched as well: for Path=/docs, /docs, /docs/Web/, and /docs/Web/HTTP will all match.
+
Secure {{optional_inline}}
+
Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistent to man-in-the-middle attacks. +

Note: Do not assume that Secure prevents all access to sensitive information in cookies (session keys, login details, etc.). Cookies with this attribute can still be read/modified with access to the client's hard disk, or from JavaScript if the HttpOnly cookie attribute is not set.

+ +

Note: Insecure sites (http:) can't set cookies with the Secure attribute (since Chrome 52 and Firefox 52). For Firefox, the https: requirements are ignored when the Secure attribute is set by localhost (since Firefox 75).

+
+
HttpOnly {{optional_inline}}
+
Forbids JavaScript from accessing the cookie, for example, through the {{domxref("Document.cookie")}} property. Note that a cookie that has been created with HttpOnly will still be sent with JavaScript-initiated requests, e.g. when calling {{domxref("XMLHttpRequest.send()")}} or {{domxref("fetch()")}}. This mitigates attacks against cross-site scripting ({{Glossary("XSS")}}).
+
SameSite=<samesite-value> {{optional_inline}}
+
Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks ({{Glossary("CSRF")}}).
+
+
+

Standards related to the SameSite Cookies recently changed such that:

+ +
    +
  1. The cookie-sending behaviour if SameSite is not specified is SameSite=Lax. Previously the default was that cookies were sent for all requests.
    2. +
  2. Cookies with SameSite=None must now
    + also specify the Secure attribute (i.e. they require a secure context).
    3. +
+ +

The options below covers the new behaviour. See the Browser compatibility table for information about specific browser implementation (rows: "SameSite: Defaults to Lax" and "SameSite: Secure context required").

+
+ Inline options are: + +
    +
  • Strict: The browser sends the cookie only for same-site requests (that is, requests originating from the same site that set the cookie). If the request originated from a different URL than the current one, no cookies with the SameSite=Strict attribute are sent.
    • +
  • Lax: The cookie is not sent on cross-site requests, such as calls to load images or frames, but is sent when a user is navigating to the origin site from an external site (e.g. if following a link).
    + This is the default behaviour if the SameSite attribute is not specified.
    • +
  • None: The browser sends the cookie with both cross-site and same-site requests. The Secure attribute must also be set when SameSite=None!
    • +
+
+
+ +

Examples

+ + + +

Session cookies are removed when the client shuts down. Cookies are session cookies if they don't specify the Expires or Max-Age attributes.

+ +
Set-Cookie: sessionId=38afes7a8
+ + + +

Instead of expiring when the client is closed, permanent cookies expire at a specific date (Expires) or after a specific length of time (Max-Age).

+ +
Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT
+
+ +
Set-Cookie: id=a3fWa; Max-Age=2592000
+ +

Invalid domains

+ +

A cookie for a domain that does not include the server that set it should be rejected by the user agent.

+ +

The following cookie will be rejected if set by a server hosted on originalcompany.com:

+ +
Set-Cookie: qwerty=219ffwef9w0f; Domain=somecompany.co.uk
+ +

A cookie for a sub domain of the serving domain will be rejected.

+ +

The following cookie will be rejected if set by a server hosted on example.com:

+ +
Set-Cookie: sessionId=e8bb43229de9; Domain=foo.example.com
+ + + +

Cookies names prefixed with __Secure- or __Host- can be used only if they are set with the secure attribute from a secure (HTTPS) origin.

+ +

In addition, cookies with the __Host- prefix must have a path of / (meaning any path at the host) and must not have a Domain attribute.

+ +
+

For clients that don't implement cookie prefixes, you cannot count on these additional assurances, and prefixed cookies will always be accepted.

+
+ +
// Both accepted when from a secure origin (HTTPS)
+Set-Cookie: __Secure-ID=123; Secure; Domain=example.com
+Set-Cookie: __Host-ID=123; Secure; Path=/
+
+// Rejected due to missing Secure attribute
+Set-Cookie: __Secure-id=1
+
+// Rejected due to the missing Path=/ attribute
+Set-Cookie: __Host-id=1; Secure
+
+// Rejected due to setting a Domain
+Set-Cookie: __Host-id=1; Secure; Path=/; Domain=example.com
+
+ +

Specifications

+ + + + + + + + + + + + + + + + + + +
SpecificationTitle
{{RFC("6265", "Set-Cookie", "4.1")}}HTTP State Management Mechanism
draft-ietf-httpbis-rfc6265bis-05Cookie Prefixes, Same-Site Cookies, and Strict Secure Cookies
+ +

Browser compatibility

+ + + +

{{Compat("http.headers.Set-Cookie", 5)}}

+ +

Compatibility notes

+ + + +

See also

+ + diff --git a/files/de/web/http/headers/set-cookie/samesite/index.html b/files/de/web/http/headers/set-cookie/samesite/index.html new file mode 100644 index 0000000000..51879c388d --- /dev/null +++ b/files/de/web/http/headers/set-cookie/samesite/index.html @@ -0,0 +1,135 @@ +--- +title: SameSite cookies +slug: Web/HTTP/Headers/Set-Cookie/SameSite +tags: + - HATTP + - IT +translation_of: Web/HTTP/Headers/Set-Cookie/SameSite +--- +
{{HTTPSidebar}}
+ +

The SameSite attribute of the {{HTTPHeader("Set-Cookie")}} HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.

+ +
+

Standards related to the Cookie SameSite attribute recently changed such that:

+ + + +

This article documents the new standard. See Browser Compatibility below for information about specific versions where the behaviour changed.

+
+ +

Values

+ +

The SameSite attribute accepts three values:

+ +

Lax

+ +

Cookies are not sent on normal cross-site subrequests (for example to load images or frames into a third party site), but are sent when a user is navigating to the origin site (i.e. when following a link).

+ +

This is the default cookie value if SameSite has not been explicitly specified in recent browser versions (see the "SameSite: Defaults to Lax" feature in the Browser Compatibility).

+ +
+

Lax replaced None as the default value in order to ensure that users have reasonably robust defense against some classes of cross-site request forgery ({{Glossary("CSRF")}}) attacks.

+
+ +

Strict

+ +

Cookies will only be sent in a first-party context and not be sent along with requests initiated by third party websites.

+ +

None

+ +

Cookies will be sent in all contexts, i.e in responses to both first-party and cross-origin requests.If SameSite=None is set, the cookie Secure attribute must also be set (or the cookie will be blocked).

+ +

Fixing common warnings

+ +

SameSite=None requires Secure

+ +

Warnings like the ones below might appear in your console:

+ +
Cookie “myCookie” rejected because it has the “SameSite=None” attribute but is missing the “secure” attribute.
+
+This Set-Cookie was blocked because it had the "SameSite=None" attribute but did not have the "Secure" attribute, which is required in order to use "SameSite=None".
+ +

The warning appears because any cookie that requests SameSite=None but is not marked Secure will be rejected.

+ +
Set-Cookie: flavor=choco; SameSite=None
+ +

To fix this, you will have to add the Secure attribute to your SameSite=None cookies.

+ +
Set-Cookie: flavor=choco; SameSite=None; Secure
+ +

A Secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Note that insecure sites (http:) can't set cookies with the Secure directive.

+ +
+

On older browser versions you might simply get a warning that the cookie will be blocked in future. For example:

+ +
Cookie “myCookie” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite” attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+
+
+ +

Cookies without SameSite default to SameSite=Lax

+ +

Recent versions of modern browsers provide a more secure default for SameSite to your cookies and so the following message might appear in your console:

+ +
Cookie “myCookie” has “SameSite” policy set to “Lax” because it is missing a “SameSite” attribute, and “SameSite=Lax” is the default value for this attribute.
+
+ +

The warning appears because the SameSite policy for a cookie was not explicitly specified:

+ +
Set-Cookie: flavor=choco
+ +

You should explicitly communicate the intended SameSite policy for your cookie (rather than relying on browsers to apply SameSite=Lax automatically). This will also improve the experience across browsers as not all of them default to Lax yet.

+ +
Set-Cookie: flavor=choco; SameSite=Lax
+ +

Example:

+ +
RewriteEngine on
+RewriteBase "/"
+RewriteCond "%{HTTP_HOST}"       "^example\.org$" [NC]
+RewriteRule "^(.*)"              "https://www.example.org/index.html" [R=301,L,QSA]
+RewriteRule "^(.*)\.ht$"         "index.php?nav=$1 [NC,L,QSA,CO=RewriteRule;01;https://www.example.org;30/;SameSite=None;Secure]
+RewriteRule "^(.*)\.htm$"        "index.php?nav=$1 [NC,L,QSA,CO=RewriteRule;02;https://www.example.org;30/;SameSite=None;Secure]
+RewriteRule "^(.*)\.html$"       "index.php?nav=$1 [NC,L,QSA,CO=RewriteRule;03;https://www.example.org;30/;SameSite=None;Secure]
+[...]
+RewriteRule "^admin/(.*)\.html$" "admin/index.php?nav=$1 [NC,L,QSA,CO=RewriteRule;09;https://www.example.org:30/;SameSite=Strict;Secure]
+
+ +

Specifications

+ + + + + + + + + + + + + + + + + + +
SpecificationTitle
{{RFC("6265", "Set-Cookie", "4.1")}}HTTP State Management Mechanism
draft-ietf-httpbis-rfc6265bis-05Cookie Prefixes, Same-Site Cookies, and Strict Secure Cookies
+ +

Browser compatibility

+ + + +

{{Compat("http.headers.Set-Cookie", 5)}}

+ +

See also

+ + -- cgit v1.2.3-54-g00ecf