Tutorial on Cookies

[cello]

Can anyone recommend a good tutorial on the use of cookies on a web
commerce site? When I search, I find lots of information on setting
cookies and their attributes. I need more specifics on when a cookie
should be delivered and expired when using a shopping cart and checking
out.

 

[Adrienne]

Can anyone recommend a good tutorial on the use of cookies on a web
commerce site? When I search, I find lots of information on setting
cookies and their attributes. I need more specifics on when a cookie
should be delivered and expired when using a shopping cart and checking
out.

Just my own experience, but when I am creating shopping cart
functionality, as soon as the person has "checked out", I kill the cookie.
I had another situation where the cookie was set to die after two days,
and the visitor was advised as such. Cookies for login purposes that
contain a userid, I usually expire in one day.

You should also know that visitors can block all cookies, including
session cookies.

Make sure that you test for cookies if your application is dependant on
them. If the visitor is not accepting cookies, you should have a
"nocookies" page that nicely explains why the cookies are necessary, how
long they persist, and how to enable them.

 

[cello]

Just my own experience, but when I am creating shopping cart
functionality, as soon as the person has "checked out", I kill the
cookie. I had another situation where the cookie was set to die
after two days, and the visitor was advised as such. Cookies for
login purposes that contain a userid, I usually expire in one day.

Thanks for your help. This is one of the questions I have - Do you use
multiple cookies for one visitor? one for userid? one for a shopping
cart?

You should also know that visitors can block all cookies, including
session cookies.

Make sure that you test for cookies if your application is dependant
on them. If the visitor is not accepting cookies, you should have a
"nocookies" page that nicely explains why the cookies are necessary,
how long they persist, and how to enable them.

What triggers the "nocookies" page? Is that information gathered through
a HTTP header when a user's browser is set not to accept cookies? or
when
a cookie is refused by a user's browser? How do you test for cookies?

Am I overlooking something obvious? Excuse me if my questions are naive
but
I haven't found this information clearly stated anywhere. Thanks again.

 

[Toby A Inkster]

How do you test for cookies?

One way would be: as soon as the visitor enters your site, say in
index.php, set a cookie and then redirect them to gateway.php.

gateway.php will test if a cookie has been sent, if no cookie then
redirect to nocookies.php. Otherwise, redirect to the main part of the
site.

This isn't neccessarily the best way of doing it, but you get the general
idea.

 

[Adrienne]

Thanks for your help. This is one of the questions I have - Do you use
multiple cookies for one visitor? one for userid? one for a shopping
cart?

You can set different cookies for different things,
(ASP example)
response.cookies("sitename")("userid") = "12345"
response.cookies("sitename")("city")= "Glendale"
response.cookies("sitename")("color")= "blue"

With that you are setting keys for the SiteName, and you can loop through
the different values.

What triggers the "nocookies" page? Is that information gathered through
a HTTP header when a user's browser is set not to accept cookies? or
when
a cookie is refused by a user's browser? How do you test for cookies?

Am I overlooking something obvious? Excuse me if my questions are naive
but
I haven't found this information clearly stated anywhere. Thanks again.

You need to request the cookie information. In the above example,

If request.cookies("sitename").haskeys then
for each item in request.cookies("sitename")
response.write item & "=" & request.cookies(item)
next
else
'send them to a no cookie page
response.redirect "nocookies.asp"
end if

Or, you can also test for session cookies (a slightly different animal)

<a href="cookietest.asp?thesessidid=<%=Session.SessionID%>">test for
session cookies</a>

Then on cookietest.asp you test like this:

thesessionid = request.querystring("thesessionid")
if session.sessionid <> thesessionid then
response.redirect "nocookies.asp"
else
'the two equal so session cookies are enabled
'set whatever or do whatever you want here
end if

Note: the above examples are in ASP, and I'm writing them from memory, so
the code might be a little faulty. I'm sure other scripting languages are
probably similar.