Setting and Retrieving Cookies in ASP - Managing User Data

The Expires property expects to receive a specific date when the cookie should expire. For example, the following code will set your user information cookie to expire on August 1, 2000.

In VBScript, you specify a literal date by surrounding it with pound signs (#). There are also many other ways you could specify the expiration date, giving you flexibility in how you manage cookie lifetimes.

<%
' Setting cookie to expire on a specific date
Response.Cookies("User Information").Expires = #August 1, 2000#
%>

Different Ways to Specify Expiration Dates

There are several valid methods for setting the Expires property to a fixed date. Each of these formats works in VBScript and gives you different options depending on your coding style.

• #January 27, 2001# - Literal date with pound signs
• "1/27/2001" - String format
• CDate("1/27/2001") - Explicit conversion using CDate function
• DateSerial(2001, 1, 27) - Using DateSerial function with year, month, day

<%
' Different ways to set cookie expiration dates
Response.Cookies("Cookie1").Expires = #January 27, 2001#
Response.Cookies("Cookie2").Expires = "1/27/2001"
Response.Cookies("Cookie3").Expires = CDate("1/27/2001")
Response.Cookies("Cookie4").Expires = DateSerial(2001, 1, 27)
%>

Using Relative Dates with the Date Function

What if you want the cookie to expire a fixed number of days or weeks from the current date? To do this, use the Date function. The Date function allows you to add a number to it to increment or decrement the date value returned.

For example, if you want to obtain a date five days in the future, Date + 5 would do the trick. Date - 5 would return a date five days in the past. This syntax is helpful when setting the Expires property of the collection.

Rarely do you want cookies to expire on a specific date. Far more often, you'll want your cookies to expire a certain number of days, weeks, or months in the future. Let's say you wanted to set the cookie MyCookie to expire in a week from the current date.

<%
' Set cookie to expire in 7 days
Response.Cookies("MyCookie").Expires = Date + 7

' Common relative expiration patterns
Response.Cookies("SessionCookie").Expires = Date + 1    ' Tomorrow
Response.Cookies("WeeklyCookie").Expires = Date + 7     ' One week
Response.Cookies("MonthlyCookie").Expires = Date + 30   ' 30 days
Response.Cookies("YearlyCookie").Expires = Date + 365   ' One year
%>

Understanding Domain and Path Properties

Keep in mind that cookies can only be read by a specified website. There's a Domain property that you can set using the Response.Cookies collection. This property, which is equal to your website's domain name by default, allows you to enter a different domain name if needed.

The Path property also determines how cookies can be read. This property can be set to allow cookies to only be read by ASP pages in certain directories. By default, this property is set to your website's root directory, which allows cookies created by an ASP page existing in any directory to be read by an ASP page in any directory.

Important: It's strongly suggested that you don't change or alter the Domain or Path properties. If you leave both properties as the defaults, you'll have no trouble reading the cookies you've created on your website. If you set your Domain or Path incorrectly, you may not be able to successfully read the cookies you write on your client's computer.

The Secure Property

Yet another property is the Secure property. This write-only, Boolean property determines whether a cookie will be sent through a non-secure protocol. If this property is set to True, the cookies will only be sent when accessing a page using the HTTPS protocol.

If this property is set to False (its default value), then the cookie will be transmitted over both HTTP and HTTPS. This is useful when you're dealing with sensitive information that should only be transmitted over encrypted connections.

<%
' Setting various cookie properties
Response.Cookies("UserData").Value = "sensitive_information"
Response.Cookies("UserData").Expires = Date + 7
Response.Cookies("UserData").Secure = True  ' Only over HTTPS

' Default properties (recommended)
Response.Cookies("NormalCookie").Value = "normal_data"
Response.Cookies("NormalCookie").Expires = Date + 30
' Domain and Path use defaults (don't change these)
%>

Reading Cookie Values

Once you've set a cookie, you'll need to retrieve it on subsequent page visits. You can read cookie values using the Request.Cookies collection. Here's how you'd check if a cookie exists and retrieve its value.

<%
' Check if cookie exists and read it
If Request.Cookies("UserData") <> "" Then
    ' Cookie exists, use it
    Dim userData
    userData = Request.Cookies("UserData")
    Response.Write "Welcome back! User Data: " & userData
Else
    ' Cookie doesn't exist
    Response.Write "No cookie found. Setting new cookie..."
    Response.Cookies("UserData").Value = "new_user"
    Response.Cookies("UserData").Expires = Date + 7
End If
%>

Cookie Best Practices

When working with cookies, follow these best practices. Always set expiration dates, as cookies without expiration dates are deleted when the browser closes. Use relative dates for most scenarios, as they're easier to manage than specific dates.

Avoid changing Domain and Path properties unless you have a specific need. Never store sensitive information in cookies without encryption. Test your cookie implementation across different browsers to ensure compatibility. Remember that users can disable cookies, so always have a fallback plan for your application.