f915bf9c65fa786cdd480b967b886e31803635bb9b486d27b7edaef747b86d258c2ee55d5e5ce51a9c12facf3a9afe2013854add397e7a2efa0ba98c9d64ea 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351
  1. <p align="center">
  2. <img src="https://cloud.githubusercontent.com/assets/835857/14581711/ba623018-0436-11e6-8fce-d2ccd4d379c9.gif">
  3. </p>
  4. # JavaScript Cookie [![Build Status](https://travis-ci.com/js-cookie/js-cookie.svg?branch=master)](https://travis-ci.com/js-cookie/js-cookie) [![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=b3VDaHAxVDg0NDdCRmtUOWg0SlQzK2NsRVhWTjlDQS9qdGJoak1GMzJiVT0tLVhwZHNvdGRoY284YVRrRnI3eU1JTnc9PQ==--5e88ffb3ca116001d7ef2cfb97a4128ac31174c2)](https://www.browserstack.com/automate/public-build/b3VDaHAxVDg0NDdCRmtUOWg0SlQzK2NsRVhWTjlDQS9qdGJoak1GMzJiVT0tLVhwZHNvdGRoY284YVRrRnI3eU1JTnc9PQ==--5e88ffb3ca116001d7ef2cfb97a4128ac31174c2) [![JavaScript Style Guide](https://img.shields.io/badge/code_style-standard-brightgreen.svg)](https://standardjs.com) [![Code Climate](https://codeclimate.com/github/js-cookie/js-cookie.svg)](https://codeclimate.com/github/js-cookie/js-cookie) [![npm](https://img.shields.io/github/package-json/v/js-cookie/js-cookie)](https://www.npmjs.com/package/js-cookie) [![size](https://img.shields.io/bundlephobia/minzip/js-cookie/3)](https://www.npmjs.com/package/js-cookie) [![jsDelivr Hits](https://data.jsdelivr.com/v1/package/npm/js-cookie/badge?style=rounded)](https://www.jsdelivr.com/package/npm/js-cookie)
  5. A simple, lightweight JavaScript API for handling cookies
  6. - Works in [all](https://www.browserstack.com/automate/public-build/b3VDaHAxVDg0NDdCRmtUOWg0SlQzK2NsRVhWTjlDQS9qdGJoak1GMzJiVT0tLVhwZHNvdGRoY284YVRrRnI3eU1JTnc9PQ==--5e88ffb3ca116001d7ef2cfb97a4128ac31174c2) browsers
  7. - Accepts [any](#encoding) character
  8. - [Heavily](test) tested
  9. - No dependency
  10. - Supports ES modules
  11. - Supports AMD/CommonJS
  12. - [RFC 6265](https://tools.ietf.org/html/rfc6265) compliant
  13. - Useful [Wiki](https://github.com/js-cookie/js-cookie/wiki)
  14. - Enable [custom encoding/decoding](#converters)
  15. - **< 800 bytes** gzipped!
  16. **👉👉 If you're viewing this at https://github.com/js-cookie/js-cookie, you're reading the documentation for the master branch.
  17. [View documentation for the latest release.](https://github.com/js-cookie/js-cookie/tree/latest#readme) 👈👈**
  18. ## Installation
  19. ### NPM
  20. JavaScript Cookie supports [npm](https://www.npmjs.com/package/js-cookie) under the name `js-cookie`.
  21. ```
  22. $ npm i js-cookie
  23. ```
  24. The npm package has a `module` field pointing to an ES module variant of the library, mainly to provide support for ES module aware bundlers, whereas its `browser` field points to an UMD module for full backward compatibility.
  25. ### Direct download
  26. Starting with version 3 [releases](https://github.com/js-cookie/js-cookie/releases) are distributed with two variants of this library, an ES module as well as an UMD module.
  27. Note the different extensions: `.mjs` denotes the ES module, whereas `.js` is the UMD one.
  28. Example for how to load the ES module in a browser:
  29. ```html
  30. <script type="module" src="/path/to/js.cookie.mjs"></script>
  31. <script type="module">
  32. import Cookies from '/path/to/js.cookie.mjs'
  33. Cookies.set('foo', 'bar')
  34. </script>
  35. ```
  36. _Not all browsers support ES modules natively yet_. For this reason the npm package/release provides both the ES and UMD module variant and you may want to include the ES module along with the UMD fallback to account for this:
  37. ```html
  38. <script type="module" src="/path/to/js.cookie.mjs"></script>
  39. <script nomodule defer src="/path/to/js.cookie.js"></script>
  40. ```
  41. Here we're loading the nomodule script in a deferred fashion, because ES modules are deferred by default. This may not be strictly necessary depending on how you're using the library.
  42. ### CDN
  43. Alternatively, include it via [jsDelivr CDN](https://www.jsdelivr.com/package/npm/js-cookie).
  44. ## ES Module
  45. Example for how to import the ES module from another module:
  46. ```javascript
  47. import Cookies from 'js-cookie'
  48. Cookies.set('foo', 'bar')
  49. ```
  50. ## Basic Usage
  51. Create a cookie, valid across the entire site:
  52. ```javascript
  53. Cookies.set('name', 'value')
  54. ```
  55. Create a cookie that expires 7 days from now, valid across the entire site:
  56. ```javascript
  57. Cookies.set('name', 'value', { expires: 7 })
  58. ```
  59. Create an expiring cookie, valid to the path of the current page:
  60. ```javascript
  61. Cookies.set('name', 'value', { expires: 7, path: '' })
  62. ```
  63. Read cookie:
  64. ```javascript
  65. Cookies.get('name') // => 'value'
  66. Cookies.get('nothing') // => undefined
  67. ```
  68. Read all visible cookies:
  69. ```javascript
  70. Cookies.get() // => { name: 'value' }
  71. ```
  72. _Note: It is not possible to read a particular cookie by passing one of the cookie attributes (which may or may not
  73. have been used when writing the cookie in question):_
  74. ```javascript
  75. Cookies.get('foo', { domain: 'sub.example.com' }) // `domain` won't have any effect...!
  76. ```
  77. The cookie with the name `foo` will only be available on `.get()` if it's visible from where the
  78. code is called; the domain and/or path attribute will not have an effect when reading.
  79. Delete cookie:
  80. ```javascript
  81. Cookies.remove('name')
  82. ```
  83. Delete a cookie valid to the path of the current page:
  84. ```javascript
  85. Cookies.set('name', 'value', { path: '' })
  86. Cookies.remove('name') // fail!
  87. Cookies.remove('name', { path: '' }) // removed!
  88. ```
  89. _IMPORTANT! When deleting a cookie and you're not relying on the [default attributes](#cookie-attributes), you must pass the exact same path and domain attributes that were used to set the cookie:_
  90. ```javascript
  91. Cookies.remove('name', { path: '', domain: '.yourdomain.com' })
  92. ```
  93. _Note: Removing a nonexistent cookie neither raises any exception nor returns any value._
  94. ## Namespace conflicts
  95. If there is any danger of a conflict with the namespace `Cookies`, the `noConflict` method will allow you to define a new namespace and preserve the original one. This is especially useful when running the script on third party sites e.g. as part of a widget or SDK.
  96. ```javascript
  97. // Assign the js-cookie api to a different variable and restore the original "window.Cookies"
  98. var Cookies2 = Cookies.noConflict()
  99. Cookies2.set('name', 'value')
  100. ```
  101. _Note: The `.noConflict` method is not necessary when using AMD or CommonJS, thus it is not exposed in those environments._
  102. ## Encoding
  103. This project is [RFC 6265](http://tools.ietf.org/html/rfc6265#section-4.1.1) compliant. All special characters that are not allowed in the cookie-name or cookie-value are encoded with each one's UTF-8 Hex equivalent using [percent-encoding](http://en.wikipedia.org/wiki/Percent-encoding).
  104. The only character in cookie-name or cookie-value that is allowed and still encoded is the percent `%` character, it is escaped in order to interpret percent input as literal.
  105. Please note that the default encoding/decoding strategy is meant to be interoperable [only between cookies that are read/written by js-cookie](https://github.com/js-cookie/js-cookie/pull/200#discussion_r63270778). To override the default encoding/decoding strategy you need to use a [converter](#converters).
  106. _Note: According to [RFC 6265](https://tools.ietf.org/html/rfc6265#section-6.1), your cookies may get deleted if they are too big or there are too many cookies in the same domain, [more details here](https://github.com/js-cookie/js-cookie/wiki/Frequently-Asked-Questions#why-are-my-cookies-being-deleted)._
  107. ## Cookie Attributes
  108. Cookie attribute defaults can be set globally by creating an instance of the api via `withAttributes()`, or individually for each call to `Cookies.set(...)` by passing a plain object as the last argument. Per-call attributes override the default attributes.
  109. ### expires
  110. Define when the cookie will be removed. Value must be a [`Number`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number) which will be interpreted as days from time of creation or a [`Date`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date) instance. If omitted, the cookie becomes a session cookie.
  111. To create a cookie that expires in less than a day, you can check the [FAQ on the Wiki](https://github.com/js-cookie/js-cookie/wiki/Frequently-Asked-Questions#expire-cookies-in-less-than-a-day).
  112. **Default:** Cookie is removed when the user closes the browser.
  113. **Examples:**
  114. ```javascript
  115. Cookies.set('name', 'value', { expires: 365 })
  116. Cookies.get('name') // => 'value'
  117. Cookies.remove('name')
  118. ```
  119. ### path
  120. A [`String`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String) indicating the path where the cookie is visible.
  121. **Default:** `/`
  122. **Examples:**
  123. ```javascript
  124. Cookies.set('name', 'value', { path: '' })
  125. Cookies.get('name') // => 'value'
  126. Cookies.remove('name', { path: '' })
  127. ```
  128. **Note regarding Internet Explorer:**
  129. > Due to an obscure bug in the underlying WinINET InternetGetCookie implementation, IE’s document.cookie will not return a cookie if it was set with a path attribute containing a filename.
  130. (From [Internet Explorer Cookie Internals (FAQ)](http://blogs.msdn.com/b/ieinternals/archive/2009/08/20/wininet-ie-cookie-internals-faq.aspx))
  131. This means one cannot set a path using `window.location.pathname` in case such pathname contains a filename like so: `/check.html` (or at least, such cookie cannot be read correctly).
  132. In fact, you should never allow untrusted input to set the cookie attributes or you might be exposed to a [XSS attack](https://github.com/js-cookie/js-cookie/issues/396).
  133. ### domain
  134. A [`String`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String) indicating a valid domain where the cookie should be visible. The cookie will also be visible to all subdomains.
  135. **Default:** Cookie is visible only to the domain or subdomain of the page where the cookie was created, except for Internet Explorer (see below).
  136. **Examples:**
  137. Assuming a cookie that is being created on `site.com`:
  138. ```javascript
  139. Cookies.set('name', 'value', { domain: 'subdomain.site.com' })
  140. Cookies.get('name') // => undefined (need to read at 'subdomain.site.com')
  141. ```
  142. **Note regarding Internet Explorer default behavior:**
  143. > Q3: If I don’t specify a DOMAIN attribute (for) a cookie, IE sends it to all nested subdomains anyway?
  144. > A: Yes, a cookie set on example.com will be sent to sub2.sub1.example.com.
  145. > Internet Explorer differs from other browsers in this regard.
  146. (From [Internet Explorer Cookie Internals (FAQ)](http://blogs.msdn.com/b/ieinternals/archive/2009/08/20/wininet-ie-cookie-internals-faq.aspx))
  147. This means that if you omit the `domain` attribute, it will be visible for a subdomain in IE.
  148. ### secure
  149. Either `true` or `false`, indicating if the cookie transmission requires a secure protocol (https).
  150. **Default:** No secure protocol requirement.
  151. **Examples:**
  152. ```javascript
  153. Cookies.set('name', 'value', { secure: true })
  154. Cookies.get('name') // => 'value'
  155. Cookies.remove('name')
  156. ```
  157. ### sameSite
  158. A [`String`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String), allowing to control whether the browser is sending a cookie along with cross-site requests.
  159. Default: not set.
  160. **Note that more recent browsers are making "Lax" the default value even without specifiying anything here.**
  161. **Examples:**
  162. ```javascript
  163. Cookies.set('name', 'value', { sameSite: 'strict' })
  164. Cookies.get('name') // => 'value'
  165. Cookies.remove('name')
  166. ```
  167. ### Setting up defaults
  168. ```javascript
  169. const api = Cookies.withAttributes({ path: '/', domain: '.example.com' })
  170. ```
  171. ## Converters
  172. ### Read
  173. Create a new instance of the api that overrides the default decoding implementation. All get methods that rely in a proper decoding to work, such as `Cookies.get()` and `Cookies.get('name')`, will run the given converter for each cookie. The returned value will be used as the cookie value.
  174. Example from reading one of the cookies that can only be decoded using the `escape` function:
  175. ```javascript
  176. document.cookie = 'escaped=%u5317'
  177. document.cookie = 'default=%E5%8C%97'
  178. var cookies = Cookies.withConverter({
  179. read: function (value, name) {
  180. if (name === 'escaped') {
  181. return unescape(value)
  182. }
  183. // Fall back to default for all other cookies
  184. return Cookies.converter.read(value, name)
  185. }
  186. })
  187. cookies.get('escaped') // 北
  188. cookies.get('default') // 北
  189. cookies.get() // { escaped: '北', default: '北' }
  190. ```
  191. ### Write
  192. Create a new instance of the api that overrides the default encoding implementation:
  193. ```javascript
  194. Cookies.withConverter({
  195. write: function (value, name) {
  196. return value.toUpperCase()
  197. }
  198. })
  199. ```
  200. ## TypeScript declarations
  201. ```
  202. $ npm i @types/js-cookie
  203. ```
  204. ## Server-side integration
  205. Check out the [Servers Docs](SERVER_SIDE.md)
  206. ## Contributing
  207. Check out the [Contributing Guidelines](CONTRIBUTING.md)
  208. ## Security
  209. For vulnerability reports, send an e-mail to `js-cookie at googlegroups dot com`
  210. ## Releasing
  211. We are using [release-it](https://www.npmjs.com/package/release-it) for automated releasing.
  212. Start a dry run to see what would happen:
  213. ```
  214. $ npm run release minor -- --dry-run
  215. ```
  216. Do a real release (publishes both to npm as well as create a new release on GitHub):
  217. ```
  218. $ npm run release minor
  219. ```
  220. _GitHub releases are created as a draft and need to be published manually!
  221. (This is so we are able to craft suitable release notes before publishing.)_
  222. ## Supporters
  223. <p>
  224. <a href="https://www.browserstack.com/"><img src="https://raw.githubusercontent.com/wiki/js-cookie/js-cookie/Browserstack-logo%402x.png" width="150"></a>
  225. </p>
  226. Many thanks to [BrowserStack](https://www.browserstack.com/) for providing unlimited browser testing free of cost.
  227. ## Authors
  228. - [Klaus Hartl](https://github.com/carhartl)
  229. - [Fagner Brack](https://github.com/FagnerMartinsBrack)
  230. - And awesome [contributors](https://github.com/js-cookie/js-cookie/graphs/contributors)