imported>廣九直通車：also

2025-11-21T00:44:15Z

also

新页面

{{noteTA
|G1=IT
|1=zh-hans:点击; zh-hant:點選
|2=zh-hans:跟踪; zh-hant:追蹤
}}
{{other uses}}
{{HTTP}}
'''HTTP cookie'''，简称'''cookie'''，又稱'''数码存根'''、'''小型文字檔案'''、「'''網站／瀏覽＋魔餅／魔片'''」等，是浏览[[网站]]时由[[网络服务器]]创建并由[[网页浏览器]]存放在用户计算机或其他设备的小文本文件。Cookie使Web服务器能在用户的设备存储状态信息（如添加到在线商店购物车中的商品）或跟踪用户的浏览活动（如点击特定按钮、登录或记录历史）<ref>{{Cite web |date=2018-07-17 |title=What are cookies? What are the differences between them (session vs. persistent)? |url=https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117925-technote-csc-00.html |work=Cisco |language=en |access-date=2022-08-25 |archive-date=2022-03-17 |archive-url=https://web.archive.org/web/20220317065522/https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117925-technote-csc-00.html |dead-url=no }}</ref>。

== 历史 ==
“cookie”一词由网络浏览器程序员[[盧·蒙特利]]创造，源自“magic cookie”（1979年就已经出现，当时指[[UNIX]]程序收发的数据包）<ref name="wdi6I">{{Cite web |title=Wherecookiecomes from :: DominoPower |url=http://dominopower.com/article/where-cookie-comes-from/ |work=dominopower.com |archive-url=https://web.archive.org/web/20171019174750/http://dominopower.com/article/where-cookie-comes-from/ |archive-date=19 October 2017 |access-date=19 October 2017}}</ref><ref name="xVtjM">{{Cite web |title=magiccookie|url=http://catb.org/jargon/html/M/magic-cookie.html |work=The Jargon File (version 4.4.7) |archive-url=https://web.archive.org/web/20170906230653/http://www.catb.org/jargon/html/M/magic-cookie.html |archive-date=6 September 2017 |access-date=8 September 2017}}</ref>。“magic cookie”这词本身来自[[幸运饼干|幸运饼]]<ref>{{Cite web |title=Why are internet cookies called cookies? |url=https://www.inlife.co.uk/why-are-cookies-called-cookies/ |access-date=2022-08-25 |archive-date=2022-07-12 |archive-url=https://web.archive.org/web/20220712144622/https://www.inlife.co.uk/why-are-cookies-called-cookies/ |dead-url=no }}</ref>。

盧·蒙特利在1994年6月<ref name="N4WV7">{{Cite news|url=https://www.nytimes.com/2001/09/04/technology/04COOK.html|work=The New York Times|first=John|author=Schwartz|title=Giving Web a Memory Cost Its Users Privacy|date=2001-09-04|accessdate=2017-02-19|archiveurl=https://www.webcitation.org/61DWugEhM?url=http://www.nytimes.com/2001/09/04/technology/04COOK.html|archivedate=2011-08-26}}</ref>想到这点子时正在[[網景]]工作，公司则正在为[[世通公司|MCI]]开发[[电子商务]]应用程序。[[文頓·瑟夫]]和[[約翰·克倫辛]]代表MCI与网景讨论技术，表示不希望总是由其服务器保存事务状态，而要求网景将状态存储在用户计算机。Cookies便是网景提出的解决方案<ref name="kesan">Kesan, Jey; and Shah, Rajiv; [https://ssrn.com/abstract=597543 ''Deconstructing Code''] {{Webarchive|url=https://wayback.archive-it.org/all/20180819022850/https://papers.ssrn.com/sol3/papers.cfm?abstract_id=597543|date=2018-08-19}}, SSRN.com, chapter II.B (Netscape's cookies), Yale Journal of Law and Technology, 6, 277–389</ref><ref name="kristol">Kristol, David; ''HTTP Cookies: Standards, privacy, and politics'', ACM Transactions on Internet Technology, 1(2), 151–198, 2001 {{Doi|10.1145/502152.502153}} (an expanded version is freely available at {{Cite web |url=http://arxiv.org/abs/cs.SE/0105018 |title=存档副本 |access-date=2022-08-25 |archive-date=2014-07-16 |archive-url=https://web.archive.org/web/20140716051321/http://arxiv.org/abs/cs.SE/0105018 |dead-url=unfit }}<span> arXiv:cs/0105018v1 [cs.SE</span>])</ref>。

同年，蒙特利与约翰·詹南德雷亚一起编写了最初的网景cookie规范。1994年10月13日发布的[[网景导航者]]0.9beta版开始支持cookie<ref name="OAHCv">{{Cite journal |last=Kristol |first=David M. |date=November 2001 |title=HTTP Cookies |url=http://dx.doi.org/10.1145/502152.502153 |journal=ACM Transactions on Internet Technology |volume=1 |issue=2 |pages=151–198 |arxiv=cs/0105018 |doi=10.1145/502152.502153 |issn=1533-5399}}</ref>。它公开的首次使用目的是检查网景网站的访问者是否已经访问过该网站。蒙特利于1995年申请了cookie技术的专利，1998年获批（{{Cite patent|US|5774670}}）。1995年10月发布的第2版[[Internet Explorer]]也宣布支持cookie<ref name="95BiI">{{Cite news|first=Sandi|author=Hardmeier|url=https://www.microsoft.com/windows/IE/community/columns/historyofie.mspx|title=The history of Internet Explorer|publisher=Microsoft|date=2005-08-25|accessdate=2009-01-04|archiveurl=https://web.archive.org/web/20051001113951/http://www.microsoft.com/windows/IE/community/columns/historyofie.mspx|archivedate=2005-10-01}}</ref>。

当时，cookie并未为公众所知，虽然默认用户接受cookie，网站并不会通知用户其存在。1996年2月12日，英国《[[金融時報 (英國)|金融时报]]》发表文章介绍cookie，使其为大众所知<ref name="B3JMd">{{Cite news|author=Jackson|first=T|title=This Bug in Your PC is a Smart Cookie|work=Financial Times|date=1996-02-12}}</ref>。其潜在的隐私问题也引起讨论，1996年和1997年的美国[[联邦贸易委员会]]两次就cookie举行听证会<ref name="UjTred">{{Cite web |first=Robert |author=Vamosi |date=2008-04-14 |title=Gmailcookiestolen via Google Spreadsheets |url=http://news.cnet.com/8301-10789_3-9918582-57.html |work=News.cnet.com |archive-url=https://web.archive.org/web/20131209210402/http://news.cnet.com/8301-10789_3-9918582-57.html |archive-date=9 December 2013 |access-date=19 October 2017}}</ref>。

[[互联网工程任务组]]专门成立了工作小组规范cookie的用法。布莱恩·贝伦多夫和大卫·克里斯托分别提出两套有关HTTP事务状态的替代方案。但由克里斯托本人和蒙特利领导的小组很快决定还是使用网景规范。1996年2月，工作组将第三方cookie确定为严重隐私威胁。该小组制定的规范RFC 2109最终于1997年2月发布，要求第三方cookie要么根本不允许，要么至少默认不启用。<ref>{{Cite web |title=Rfc2109 |url=https://datatracker.ietf.org/doc/html/rfc2109#section-8.3 |access-date=2022-08-25 |archive-date=2022-08-01 |archive-url=https://web.archive.org/web/20220801202654/https://datatracker.ietf.org/doc/html/rfc2109#section-8.3 |dead-url=no }}</ref>

网景的cookie[[HTTP头字段|头字段]]为<code>Set-Cookie</code>，RFC 2965<nowiki/>添加了<code>Set-Cookie2</code>头字段，即“RFC 2965 cookie”<ref name="AGgFj">{{Cite web |date=June 19, 2009 |title=Setting Cookies |url=https://staff.washington.edu/fmf/2009/06/19/setting-cookies/ |work=staff.washington.edu |archive-url=https://web.archive.org/web/20170316175133/https://staff.washington.edu/fmf/2009/06/19/setting-cookies/ |archive-date=March 16, 2017 |access-date=March 15, 2017}}</ref><ref name="V1mES">The edbrowse documentation version 3.5 said "Note that only Netscape-style cookies are supported. However, this is the most common flavor of cookie. It will probably meet your needs." This paragraph was removed in [http://edbrowse.org/usersguide.html#cook later versions of the documentation] {{Webarchive|url=https://web.archive.org/web/20170316024448/http://edbrowse.org/usersguide.html#cook|date=2017-03-16}} further to RFC 2965's deprecation.</ref>，但<code>Set-Cookie2</code>很少使用，终于2011年4月的RFC 6265中弃用<ref name="StateMgmt">{{Cite web |first=Jeff |author=Hodges |date=6 March 2011 |title='HTTP State Management Mechanism' to Proposed Standard |url=http://www.thesecuritypractice.com/the_security_practice/2011/03/http-state-management-mechanism-to-proposed-standard.html |work=The Security Practice |archive-url=https://web.archive.org/web/20160807062741/http://www.thesecuritypractice.com/the_security_practice/2011/03/http-state-management-mechanism-to-proposed-standard.html |archive-date=7 August 2016 |access-date=17 June 2016}}</ref>，已经没有现代浏览器可以识别<code>Set-Cookie2</code>头字段<ref name="TASE4">{{Cite web |title=Set-Cookie2 - HTTP {{!}} MDN |url=https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie2 |work=developer.mozilla.org |access-date=2021-03-08 |archive-date=2022-03-02 |archive-url=https://web.archive.org/web/20220302203956/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie2 |dead-url=no }}</ref>。

== 结构 ==
Cookie的基本结构包括<ref name="Peng, Weihong 2000">{{Cite journal |last=Peng, Weihong |last2=Cisna, Jennifer |year=2000 |title=HTTP Cookies, A Promising Technology |journal=ProQuest |publisher=Online Information Review |id={{ProQuest|194487945}}}}<templatestyles src="Module:Citation/CS1/styles.css" /></ref><ref name="Stenberg, Daniel 2009">Jim Manico quoting Daniel Stenberg, [http://manicode.blogspot.it/2009/08/real-world-cookie-length-limits.html Real worldcookielength limits] {{Webarchive|url=https://web.archive.org/web/20130702114435/http://manicode.blogspot.it/2009/08/real-world-cookie-length-limits.html|date=2013-07-02}}</ref><ref>{{Cite journal |last=Lee |first=Wei-Bin |last2=Chen |first2=Hsing-Bai |last3=Chang |first3=Shun-Shyan |last4=Chen |first4=Tzung-Her |date=2019-01-25 |title=Secure and efficient protection for HTTP cookies with self-verification |url=https://onlinelibrary.wiley.com/doi/10.1002/dac.3857 |journal=International Journal of Communication Systems |language=en |volume=32 |issue=2 |pages=e3857 |doi=10.1002/dac.3857 |access-date=2022-08-25 |archive-date=2022-06-10 |archive-url=https://web.archive.org/web/20220610092201/https://onlinelibrary.wiley.com/doi/10.1002/dac.3857 |dead-url=no }}</ref>

# 名；
# 值；
#各种属性。

===属性===
一塊cookie可能有Domain、Path、Expires、Max-Age、Secure、HttpOnly等多種属性，如

<syntaxhighlight lang="http">
HTTP/1.0 200 OK
Set-Cookie: LSID=DQAAAK…Eaem_vYg; Path=/accounts; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Secure; HttpOnly
Set-Cookie: HSID=AYQEVn…DKrdst; Domain=.foo.com; Path=/; Expires=Wed, 13 Jan 2021 22:23:01 GMT; HttpOnly
Set-Cookie: SSID=Ap4P…GTEq; Domain=foo.com; Path=/; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Secure; HttpOnly
…
</syntaxhighlight>

==== Domain和Path ====
<code>Domain</code>和<code>Path</code>属性定义了cookie的范围。它们告诉浏览器cookie属于什麼网站。Cookies只能设置在当前资源的顶级域及其子域上。

如果服务器未指定cookie的<code>Domain</code>和<code>Path</code>，则它们默认为所请求资源的域和路径<ref name="uMnRY">{{Cite web |date=March 2014 |title=HTTP State Management Mechanism, The Path Attribute |url=http://tools.ietf.org/html/rfc6265#section-4.1.2.4 |work=IETF |archive-url=https://web.archive.org/web/20110501105323/http://tools.ietf.org/html/rfc6265#section-4.1.2.4 |archive-date=2011-05-01 |access-date=2011-05-12}}</ref>。

==== Expires和Max-Age ====
<code>Expires</code>属性定义了浏览器应删除cookie的时间，格式为<code>Wdy, DD Mon YYYY HH:MM:SS GMT</code>或<code>Wdy, DD Mon YY HH:MM:SS GMT</code>（YY大于或等于0并且小于等于69）。<ref name="QKuwv">{{Cite web |title=RFC 6265, HTTP State Management Mechanism |url=http://tools.ietf.org/html/rfc6265#section-5.1.1 |url-status=live |website=ietf.org |archive-url=https://web.archive.org/web/20110501105323/http://tools.ietf.org/html/rfc6265#section-5.1.1 |archive-date=2011-05-01 |access-date=2011-05-12}}</ref>

此外也可用<code>Max-Age</code>将cookie的过期时间设置为某一段时间之后（相对于浏览器接收cookie的时间而言）。但Internet Explorer等浏览器可能不支持<code>Max-Age</code><ref name="nyQ00">{{Cite web |date=2016 |title=Cookies specification compatibility in modern browsers |url=https://inikulin.github.io/cookie-compat/#MOZILLA0001 |url-status=live |website=inikulin.github.io |archive-url=https://web.archive.org/web/20161002124029/http://inikulin.github.io/cookie-compat/#MOZILLA0001 |archive-date=2016-10-02 |access-date=2016-09-30}}</ref><ref name="wASD0">{{Cite web |last=Coles |first=Peter |title=HTTP Cookies: What's the difference between Max-age and Expires? – Peter Coles |url=http://mrcoles.com/blog/cookies-max-age-vs-expires/ |url-status=live |website=Mrcoles.com |archive-url=https://web.archive.org/web/20160729011727/http://mrcoles.com/blog/cookies-max-age-vs-expires/ |archive-date=29 July 2016 |access-date=28 July 2016}}</ref>。

==== Secure和HttpOnly ====
<code>Secure</code>属性旨在将cookie加密，使浏览器仅通过[[超文本传输安全协议|安全／加密]]连接使用cookie。

<code>HttpOnly</code>要求浏览器不要通过HTTP（和HTTPS）以外的渠道使用cookie。这意味着无法通过客户端脚本语言（尤其是[[JavaScript]]）访问cookie，因此无法通过[[跨網站指令碼|跨站点脚本攻击]]轻易窃取。<ref name="Symantec-2007-2nd-exec">{{Cite journal |date=April 2008 |title=Symantec Internet Security Threat Report: Trends for July–December 2007 (Executive Summary) |url=http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_exec_summary_internet_security_threat_report_xiii_04-2008.en-us.pdf |url-status=live |publisher=Symantec Corp. |volume=XIII |page=1–3 |archive-url=https://web.archive.org/web/20080625065121/http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_exec_summary_internet_security_threat_report_xiii_04-2008.en-us.pdf |archive-date=June 25, 2008 |access-date=May 11, 2008}}</ref>

== 分类 ==

=== 会话cookie ===
会话cookie仅在浏览网站时临时存储<ref name="mscookie">Microsoft Support [http://support.microsoft.com/kb/223799/EN-US Description of Persistent and Per-Session Cookies in Internet Explorer] {{Webarchive|url=https://web.archive.org/web/20110925230707/http://support.microsoft.com/kb/223799/EN-US|date=2011-09-25}} Article ID 223799, 2007</ref>，关闭浏览器后会自动过期或删除<ref name="HwxT6">{{Cite web |title=Maintaining session state with cookies |url=http://msdn.microsoft.com/en-us/library/ms526029(v=vs.90).aspx |work=Microsoft Developer Network |archive-url=https://web.archive.org/web/20121014110456/http://msdn.microsoft.com/en-us/library/ms526029(v=vs.90).aspx |archive-date=14 October 2012 |access-date=22 October 2012}}</ref>。

=== 持久cookie ===
持久cookie只在其创建者设置的特定日期后过期，期间一直有效。

=== 安全cookie ===
安全cookie只能通过加密连接传输（[[超文本传输安全协议|HTTPS]]）。它们不能通过未加密的连接传输（[[超文本传输协议|HTTP]]），使cookie不易被盗。

== 用途 ==

=== 会话管理 ===
虽然最初引入cookie是为了让用户在浏览网站时记录要购买的物品<ref name="kesan"/><ref name="kristol"/>。但现在用户购物车的内容通常存储在服务器的数据库中，而不再是客户端的cookie中。

当前会话cookie的常见用途是登录。当用户访问网站的登录页面时，Web服务器通常会向客户端发送一个包含唯一会话标识符的cookie。当用户成功登录时，服务器会记住该特定会话标识符已经过身份验证，并授予用户访问其服务的权限。

=== 喜好設定 ===

许多网站用cookie存储用户偏好等设置，向用户顯示喜好內容。

=== 跟踪 ===
跟踪cookie用于跟踪记录用户的网络浏览习惯，如用户的购物习惯。

== 浏览器设置 ==
大多数现代浏览器都支持cookie并允许用户禁用它们，以下是常见选项：<ref name="eyMbr">{{Cite web |last=Whalen |first=David |date=June 8, 2002 |title=The UnofficialcookieFAQ v2.6 |url=http://www.cookiecentral.com/faq/ |url-status=live |publisher=Cookie Central |archive-url=https://web.archive.org/web/20110824223646/http://www.cookiecentral.com/faq/ |archive-date=August 24, 2011 |access-date=2009-01-04}}</ref>

* 完全启用或禁用cookie，以便它们始终被接受或始终被阻止；
* 使用cookie管理器查看和有选择地删除cookie；
* 彻底清除cookie等所有私人数据。

此外也有管理cookie权限的附加组件。<ref name="microsoft2007">{{Cite web |date=December 18, 2007 |title=How to Manage Cookies in Internet Explorer 6 |url=http://support.microsoft.com/kb/283185 |url-status=live |publisher=Microsoft |archive-url=https://web.archive.org/web/20081228074307/http://support.microsoft.com/kb/283185 |archive-date=December 28, 2008 |access-date=2009-01-04}}</ref><ref name="bv35c">{{Cite web |date=16 September 2008 |title=Clearing private data |url=http://support.mozilla.com/en-US/kb/Clearing+Private+Data#top |url-status=live |website=Firefox Support Knowledge base |publisher=Mozilla |archive-url=https://web.archive.org/web/20090103092440/http://support.mozilla.com/en-US/kb/Clearing+Private+Data#top |archive-date=3 January 2009 |access-date=2009-01-04}}</ref><ref name="zuzB8">{{Cite web |title=Clear Personal Information : Clear browsing data |url=https://www.google.com/support/chrome/bin/answer.py?answer=95582 |url-status=live |website=Google Chrome Help |archive-url=https://web.archive.org/web/20090311132912/http://www.google.com/support/chrome/bin/answer.py?answer=95582 |archive-date=2009-03-11 |access-date=2009-01-04}}</ref><ref name="xGdEB">{{Cite web |title=Clear Personal Information: Delete cookies |url=https://www.google.com/support/chrome/bin/answer.py?answer=95626 |url-status=live |website=Google Chrome Help |archive-url=https://web.archive.org/web/20090311132750/http://www.google.com/support/chrome/bin/answer.py?answer=95626 |archive-date=2009-03-11 |access-date=2009-01-04}}</ref>

==安全和私隱==
=== 第三方cookie和隐私 ===
网页可能第三方服务，使用网页很可能会遇到第三方cookie（访问网页外其他服务器的cookie）。RFC 2109<nowiki/>和<nowiki/>RFC 2965<nowiki/>要求浏览器保护用户隐私，默认不允许在服务器间共享cookie，但RFC 6265放宽。大多数浏览器只要第三方网站有合理的[[隱私權偏好平台|隐私政策]]申明，就默认允许第三方cookie。<ref name="7CU00">{{Citation|url=https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_22|journal=Mozilla Developer Network|title=Site Compatibility for Firefox 22|date=2013-04-11|access-date=2013-04-11|archiveurl=https://web.archive.org/web/20130527072626/https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_22|archivedate=2013-05-27}}</ref>

广告是第三方cookie常见的使用场景，广告公司借此跟踪用户。网站应当告知用户有第三方cookie存在，不向消费者披露第三方cookie使用情况的网站运营商可能面临法律风险，一般网站都会在[[隐私权政策|隐私或cookie政策]]说明其使用的第三方cookie。<ref name="dCj3R">Miyazaki, Anthony D. (2008), "Online Privacy and the Disclosure ofcookieUse: Effects on Consumer Trust and Anticipated Patronage," Journal of Public Policy & Marketing, 23 (Spring), 19–33</ref>

=== 窃取cookie和劫持会话 ===
很多网站用cookie作为用户的唯一标识符，但如果网站使用cookie作为会话标识符，攻击者就可以窃取受害者的全套cookie来冒充其请求。<ref>{{Cite web |title=資安人科技網 |url=https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10027 |website=資安人科技網 |language=en |access-date=2025-03-28}}</ref><ref>{{Cite web |title=Google Cookie漏洞洩露帳戶私隱｜改密碼都無用官方兩方法解決｜科技玩物 |url=https://www.hk01.com/%E6%95%B8%E7%A2%BC%E7%94%9F%E6%B4%BB/977732/google-cookie%E6%BC%8F%E6%B4%9E%E6%B4%A9%E9%9C%B2%E5%B8%B3%E6%88%B6%E7%A7%81%E9%9A%B1-%E6%94%B9%E5%AF%86%E7%A2%BC%E9%83%BD%E7%84%A1%E7%94%A8-%E5%AE%98%E6%96%B9%E5%85%A9%E6%96%B9%E6%B3%95%E8%A7%A3%E6%B1%BA |website=香港01 |date=2024-01-05 |language=zh-HK |last=陳錦洪 |access-date=2025-03-28}}</ref>

==参考文献==
{{reflist}}

==外部链接==

{{Commons category|HTTP cookies}}
* {{IETF RFC|6265|link=no}}

[[Category:入侵 (计算机安全)]]
[[Category:Web安全漏洞]]
[[Category:网络隐私]]
[[Category:计算机访问控制]]

Cookie - 版本历史

imported>廣九直通車：​also

imported>廣九直通車：also