Windows NT Internet and Intranet Development

To learn more about author Sanjaya Hettihewa, please visit the author's homepage.

Previous chapterNext chapterContents


- 21 -

Manipulating Cookies with VBScript


Cookies (client-side persistent information) are used to develop sophisticated Web applications. Cookies have been implemented to address a limitation of HTTP. HTTP is a stateless protocol. When the Web server receives an HTTP request, it fulfills it and terminates the connection between the Web server and the Web client. No information about the HTTP transaction is retained for future reference. This is a major obstacle for Web applications such as online shopping-cart applications, which need to remember certain information between HTTP connections. Cookies simply provide a mechanism to remember certain information between HTTP sessions. Examples of information that can be retained between HTTP sessions with the aid of cookies are listed next to provide you an overview of some of the applications of cookies.

Personal information:

Personal preferences:

Information about an online transaction:


URL:Visit the following Web page for additional information about client-side persistent cookies and how they are used to retain information between HTTP sessions:
See Figure 21.1 for an example of a typical HTTP transaction. Notice how no information about the HTTP transaction is retained after the HTTP connection between the Web server and the Web client is broken.

Figure 21.1. A typical HTTP transaction that does not use cookies.

Figure 21.2 demonstrates how a cookie is used to retain information about an HTTP transaction. The cookie "Repeat=Yes" is created by a VBScript application embedded in the Web page requested by the Web client. A server-side or client-side application can later examine the cookie to determine whether the Web client is a repeat visitor.

Figure 21.2. An HTTP transaction that uses cookies to remember certain information between HTTP sessions.



Applications of Cookies

Let's explore some of the applications of cookies and outline how cookies can be used to develop sophisticated Web applications. See the section found later in this chapter called "Using Cookies in VBScript Applications" to learn how cookies are used in an actual VBScript application to retain information between HTTP transactions.

Online Shopping Carts

The Internet is increasingly being used to conduct business transactions. Online shopping carts use cookies to keep track of items selected by the customer from a product catalog (similar to the one shown in Figure 21.3).

Figure 21.3. An online product catalog linked to an online shopping cart.

A cookie is updated each time an item is selected by the user. When the user finishes shopping, the online shopping-cart application examines cookie information created as a result of the customer selecting various items for purchase. The customer can pay for the items selected after the items are verified, as shown in Figure 21.4.

Figure 21.4. An online shopping-cart application keeps track of items selected for purchase by the customer.


Customized Web Pages

Customized Web pages can be dynamically created to provide personalized content to users browsing a Web site. Customized Web pages enhance the experience of browsing for information by presenting information that the user is most likely interested in.

The Microsoft Network default home page is shown in Figure 21.5. Notice how it provides the option of creating a personalized start page.


URL:Visit the Microsoft Network home page to explore how personalized Web pages are dynamically created by the Web server with the aid of cookies.

Figure 21.5. The default home page of the Microsoft Network.

Customization categories of the Microsoft Network home page are shown in Figure 21.6. Before you create your own custom start page on the Microsoft Network, enable the Warn before accepting "cookies" check box by selecting View | Options from the Internet Explorer menu bar and selecting the Advanced tab (see Figure 21.7). You can then observe how cookies are created to store certain information. More and more Web pages are using cookies to store information. You might want to turn off the warning message before accepting cookies if you find the warning messages annoying when you surf the Web.

After the Warn before accepting "cookies" check box is enabled, you can monitor the creation of cookies, as shown in Figure 21.8. The cookie in Figure 21.8 is created the first time a user visits the Microsoft Network home page.

See Figure 21.9 for the personalized home page of the Microsoft Network. Notice how the personalized home page is significantly different from the default Microsoft Network home page, shown in Figure 21.5.

Figure 21.6. Customization categories of the Microsoft Network home page.

Figure 21.7. Enable the Warn before accepting "cookies" check box.

Figure 21.8. If the check box in Figure 21.7 is enabled, a warning message is displayed when a cookie is created.

Figure 21.9. The customized home page of the Microsoft Network.


Drawbacks of Using Cookies

While client-side cookies are powerful tools for developing sophisticated Web applications, there are a number of drawbacks associated with using cookies. It is important that you consider these drawbacks before you deploy Web applications that rely on cookies to accurately identify and authenticate users.

Cookies Can Be Lost

Cookies can be lost. Never depend on cookies to store valuable and irreplaceable information. Such information should always be stored in a server-side database. Cookie information is stored in the user's hard drive. Cookies created by Internet Explorer can be found in the Cookies subdirectory of your Windows NT directory (for example, C:\WINNT\Cookies), as shown in Figure 21.10.

Figure 21.10. Cookies created by Internet Explorer can be found in the Cookies subdirectory of your Windows NT directory.

Cookie files can be corrupted, accidentally deleted, or even overwritten when installing a new version of a Web browser (possibly due to a badly written setup application). When using cookies, be prepared for a user to lose the file used to store cookies. A practical contingency plan to address the case of lost cookies is proposed in the section later in this chapter called "Addressing the Drawbacks of Using Cookies."

Cookies Can Be Changed By Users

Technically inclined users may figure out how to change the value of a cookie. Never assume cookie information is authentic. If you are using a cookie to determine the last time a user visited a Web page, it is okay to rely on the value of a cookie. However, it is not a good idea to rely on the value of a cookie to determine a user's account balance. (Ever wish you could just reset the balance of one of your credit cards by editing a file on your computer? If credit-card companies used client-side cookies to store account balances, you would be able to make that wish come true!)

As a rule of thumb, use cookies to store non-confidential information. If you need to store confidential information for future reference, store it in a server-side database, and assign an identification code and password to the user. You can store the identification code in a client-side cookie and ask the user for his password before he is able to perform a transaction (buy a laptop computer) with the user's information (credit-card number) stored in your database.

Cookies Can Be Copied

Cookies are not universally unique, even if you create a universally unique cookie for each HTTP transaction. It is possible for two computers to have the exact same cookie information. Never use cookies to store information that's unique to the user's computer (screen resolution, color depth, operating system, and so on).

Cookies Can Be Stolen

As discussed in the previous section, cookie information can be copied with or without the consent/knowledge of the owner of the cookie file.


Warning: You should never authenticate a user based only on the value of a cookie. Use a password to verify the user's identity.

Web-Browser Compatibility Issues

Both Internet Explorer and Netscape Navigator support client-side persistent cookies. Although Internet Explorer and Netscape Navigator account for over 95 percent of all Web browsers used to navigate the Internet, some users may still be using other Web browsers that do not support cookies. When designing Web pages, be sure to take this fact into consideration. Always provide a URL that can be used by a technologically challenged Web browser to access the same information available to users who use Web browsers that support cookies.

Addressing the Drawbacks of Using Cookies

As discussed earlier, cookie information can be suddenly lost or altered. A solution to this problem is storing all cookie information (user's name, e-mail address, preferences) in a server-side database. Only a reference to the data stored in the server-side database is contained in the client-side cookie (such as the record number). When this is implemented, the user can simply provide his e-mail address and password to restore the client-side cookie containing the reference to the server-side database. This ensures that a user does not have to re-enter all the information in case a cookie is lost.

You might also want to assign a password to each user for validation purposes. This prevents the misuse of stolen cookies, because only the original user who knows the password is able to use the cookie. You might want to use the user's e-mail address as the user ID to make it easier for him to remember.

Using Cookies in VBScript Applications

The VBScript application in Listing 21.1 demonstrates how to create, view, and delete cookies using the Document.Cookie object.

Listing 21.1. Using cookies in VBScript applications.

 1: <!--
 2:   © 1996 Sanjaya Hettihewa (http://www.NetInnovation.com/)
 3:   All Rights Reserved.
 4:   Permission is hereby given to modify and distribute this code
 5:   as you wish provided that this block of text remains unchanged.
 6:  !-->
 7:
 8: <html>
 9:
10: <HEAD>
11:
12: <SCRIPT LANGUAGE="VBScript">
13:   <!--
14:     Sub View_onClick()
15:       If (Document.Cookie = "") Then
16:         MsgBox "No cookie information found!"
17:       Else
18:         MsgBox "Cookie information: " & Document.Cookie
19:       End If
20:     end sub
21:
22:     Sub Create_onClick()
23:       Dim CookieName, CookieValue
24:
25:       CookieName = InputBox ("Please enter name of cookie ", _
26:               "Name of Cookie", "")
27:
28:       CookieValue = InputBox ("Please enter value of cookie ", _
29:               "Value of Cookie", "")
30:
31:       If (CookieName = "") Then
32:         MsgBox "Empty cookie names are not allowed."
33:       Else If (CookieValue = "") Then
34:         MsgBox "Empty cookie values are not allowed."
35:       Else
36:         Document.Cookie = CookieName & "=" & CookieValue
37:       End If
38:       End If
39:     end sub
40:
41:     Sub delete_onClick()
42:       Dim CookieName
43:
44:       If (Document.Cookie = "") Then
45:         MsgBox "No cookie information found!"
46:       Else
47:         CookieName = InputBox ("Please enter name of cookie ", _
48:                 "Name of Cookie to delete", "")
49:         If (InStr(Document.Cookie,CookieName)>0) Then
50:           Document.Cookie = CookieName & "=" & _
51:             "NULL;expires=Thursday, 29-Feb-96 12:00:00 GMT"
52:         Else
53:           MsgBox "The cookie name you entered does not exist!!"
54:         End If
55:       End If
56:     end sub
57:
58:   -->
59: </SCRIPT>
60:
61: <title>Using Cookies in VBScript applications</title>
62: </HEAD>
63:
64: <BODY bgcolor="#FFFFFF">
65: <P><font color="#0000FF" size="6" face="Comic Sans MS"><strong>Using
66:     Cookies in VBScript Applications</strong></font></p>
67:
68:     <FORM NAME="CookieForm">
69: <p><INPUT TYPE=button VALUE="Create a Cookie" NAME="Create">
70: <font size="4" face="Tahoma">Create a cookie</font></p>
71: <p><INPUT TYPE=button VALUE="View cookie information" NAME="View">
72: <font size="4" face="Tahoma">View cookie information</font></p>
73: <p><INPUT TYPE=button VALUE="Delete a cookie" NAME="Delete">
74: <font size="4" face="Tahoma"> Delete a cookie</font></p>
75:     </FORM>
76:
77: </BODY>
78: </html>

The application in Figure 21.11 can be found in the CD-ROM kit that accompanies this resource library in the directory \Chap-21\Cookie.html (the source code of this application is given in Listing 21.1 for your reference). For cookies to function properly, you must copy this file to a Web server directory and access the file via the Web server. If you are unable to do this, use the following URL.


URL:The VBScript application in Listing 21.1 can be found at the following Web page:

Click the Create a Cookie button, shown in Figure 21.11, to create a cookie.

Figure 21.11. The VBScript application in Listing 21.1.

The Name of Cookie dialog box (shown in Figure 21.12) appears. Use this dialog box to specify the name of the cookie. Click OK to continue.

Figure 21.12. Specifying the name of the cookie.

The Value of Cookie dialog box (shown in Figure 21.13) appears. Use this dialog box to specify the value of the cookie. Click OK to continue.

Figure 21.13. Specifying the value of the cookie.

If the Warn before accepting "cookies" check box is enabled, as shown in Figure 21.7, the Security Alert dialog box (shown in Figure 21.14) is displayed to confirm that you want to create the cookie specified in the dialog boxes shown in Figures 21.12 and 21.13. Click Yes. Line 36 of the VBScript application in Listing 21.1 generates a cookie.

Figure 21.14. Internet Explorer generates a cookie.

Click the View cookie information button, shown in Figure 21.11, to view the cookie generated by line 36 of Listing 21.1. The cookie generated is shown in Figure 21.15.

Figure 21.15. Cookie generated by Internet Explorer.

Select the Delete a cookie button shown in Figure 21.11 to delete the cookie shown in Figure 21.15. Type the name of the cookie you specified in Figure 21.12, as shown in Figure 21.16.

Figure 21.16. Specifying the name of the cookie to be deleted.

Lines 50 and 51 of Listing 21.1 delete the cookie by specifying an expiration date that has already passed. After the cookie is deleted, click the View cookie information button to verify that the cookie is deleted, and you will see the dialog box shown in Figure 21.17.

Figure 21.17. The cookie no longer exists.



URL:Visit the following Web page for additional information about manipulating cookies with VBScript:

Summary

Cookies are used to develop sophisticated Web applications that remember information between HTTP sessions. When a cookie is created, certain information is stored in the user's computer for future reference. When the Web client contacts the Web server responsible for creating the cookie, the information stored in the user's computer in the form of a cookie is sent to the Web server. This information can be used by either a client-side or server-side Web application to implement sophisticated Web applications such as shopping carts and customized Web pages.


Previous chapterNext chapterContents


© Copyright, Macmillan Computer Publishing. All rights reserved.