How do I create a persistent vs a non-persistent cookie?

Question

I can't seem to figure out how to create a persistent vs a non-persistent cookie. How do they differ, say, in the HTTP headers that are sent back?

Answer 1

Cookies have an expiration date implicitly or explicitly set which controls how long they last (subject to the user agent actually enforcing it). A cookie may persist only for the duration of the session (or an even shorter period).

If a cookie is valid, it will be passed along with the HTTP request to the domain that it originated from. Only the domain that set the cookie can read the cookie (though there are ways to exploit this, such as cross-site scripting).

• If you want a cookie to expire at a specific time, set an expiration date on it using the client or server-side language of your choice.

• If you want the cookie to expire when the session ends, don't set an expiration date.

From the RFC (emphasis mine):

The cookie setter can specify a deletion date, in which case the cookie will be removed on that date.

If the cookie setter does not specify a date, the cookie is removed once the user quits his or her browser.

As a result, specifying a date is a way for making a cookie survive across sessions. For this reason, cookies with an expiration date are called persistent.

As an example application, a shopping site can use persistent cookies to store the items users have placed in their basket. (In reality, the cookie may refer to an entry in a database stored at the shopping site, not on your computer.) This way, if users quit their browser without making a purchase and return later, they still find the same items in the basket so they do not have to look for these items again. If these cookies were not given an expiration date, they would expire when the browser is closed, and the information about the basket content would be lost.

Answer 2

There two type of cookies in ASP.NET

Persistent cookies:

Cookies are stored on your computer hard disk. They stay on your hard disk and can be accessed by web servers until they are deleted or have expired.

public void SetPersistentCookies(string name, string value)
{
    HttpCookie cookie = new HttpCookie(name);

    cookie.Value = value;

    cookie.Expires = Convert.ToDateTime(“12/12/2008″);

    Response.Cookies.Add(cookie);
}

Non-persistent cookies:

Cookies are saved only while your web browser is running. They can be used by a web server only until you close your browser. They are not saved on your disk.

public void SetNonPersistentCookies(string name, string value)
{
    HttpCookie cookie = new HttpCookie(name);

    cookie.Value = value;

    Response.Cookies.Add(cookie);
}

Answer 3

Session cookie

HttpCookie cookie = new HttpCookie("myCookieName", "myCookieValue");
Response.Cookies.Add(cookie);

Cookie with a certain time-stamp (.NET DateTime library)

HttpCookie cookie = new HttpCookie("myCookieName", "myCookieValue");
cookie.Expires = DateTime.Today.AddMonths(12); //or AddMinutes, or AddHours...
Response.Cookies.Add(cookie);

Persistent Cookie

HttpCookie cookie = new HttpCookie("myCookieName", "myCookieValue");
cookie.Expires = DateTime.MaxValue;
Response.Cookies.Add(cookie);

Answer 4

Persistent cookies have an expiration date issued to it by the web server. Basically, this type of cookie is saved on your computer so when you close it and start it up again, the cookie is still there. Once the expiration date is reached, it is destroyed by the owner.

Reference: https://www.cookiepro.com/knowledge/what-is-a-persistent-cookie/

If a cookie does not contain an expiration date, it is considered a session/non-persistent cookie.

So, basically persistent cookies come with the expires attribute e.g.

expires="Wdy, DD-Mon-YYYY HH:MM:SS GMT"