{"id":18356521,"url":"https://github.com/lbwa/spec-cookies","last_synced_at":"2025-04-10T01:49:04.688Z","repository":{"id":96822331,"uuid":"224621157","full_name":"lbwa/spec-cookies","owner":"lbwa","description":"How http cookies works.","archived":false,"fork":false,"pushed_at":"2019-11-29T05:25:46.000Z","size":37,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-03-15T00:09:08.543Z","etag":null,"topics":["cookie","http-state-management","set-cookie"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lbwa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-28T09:49:37.000Z","updated_at":"2019-11-29T05:28:20.000Z","dependencies_parsed_at":"2023-03-21T01:32:58.469Z","dependency_job_id":null,"html_url":"https://github.com/lbwa/spec-cookies","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lbwa%2Fspec-cookies","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lbwa%2Fspec-cookies/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lbwa%2Fspec-cookies/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lbwa%2Fspec-cookies/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lbwa","download_url":"https://codeload.github.com/lbwa/spec-cookies/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248142727,"owners_count":21054667,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cookie","http-state-management","set-cookie"],"created_at":"2024-11-05T22:10:34.883Z","updated_at":"2025-04-10T01:49:04.662Z","avatar_url":"https://github.com/lbwa.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003eSpec Cookies\u003c/h1\u003e\n\nThis project describes how http same-site/cross-site cookies works.\n\n## Fundamental\n\n[RFC6265 - HTTP State Management Mechanism](https://tools.ietf.org/html/rfc6265)\n\n### third-party cookies(cross-site cookies)\n\n#### Specification\n\nNote that the [HSMM](https://tools.ietf.org/html/rfc6265#section-7.1) specification grants user agents wide latitude to experiment with third-party cookie policies that balance the privacy and compatibility needs of their users. However, **it does not endorse any particular third-party cookie policy**.\n\n#### MDN\n\n- [XMLHttpRequest.withCredentials](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials)\n\n- [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials)\n\nBy default, in cross-site XMLHttpRequest or Fetch invocations, browsers will not send credentials (HTTP cookies and HTTP Authentication information). A specific flag has to be set on the XMLHttpRequest object or the Request constructor when it is invoked.\n\n```ts\n// with XMLHttpRequest(omit unrelated code)\nconst http = new XMLHttpRequest()\nhttp.open('GET', 'https://api.github.com', true)\n// set a flag used to send cross-site credentials.\n// Otherwise, cross-site credentials wouldn't be sent.\n// https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials\nhttp.withCredentials = true\n\n// with browser fetch API(omit unrelated code)\n// https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/fetch\nfetch(url, {\n  credentials: 'include'\n})\n```\n\nNote that the response headers should include [Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) with `true` value and [Access-Control-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin) with a **specific** origin domain, instead of the `*` wildcard.\n\n## Prerequisites\n\n1. Should run the following command to create local ssl certification which is used to https server.\n\n   ```bash\n   npm run setup\n   ```\n\n2. Modify your `/etc/host` file\n\n   ```txt\n   127.0.0.1 domain.com\n   127.0.0.1 main.domain.com\n   127.0.0.1 sub.domain.com\n   ```\n\n## Installation\n\n- Start https server\n\n  ```bash\n  npm run start-https\n  ```\n\n- Browse web page\n\n  ```bash\n  https://domain.com:5000\n\n  # or\n  https://main.domain.com:5000\n\n  # or\n  https://sub.domain.com:5000\n  ```\n\n## License\n\nMIT © [Bowen Liu](https://github.com/lbwa)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flbwa%2Fspec-cookies","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flbwa%2Fspec-cookies","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flbwa%2Fspec-cookies/lists"}