Question

The way to delete cookies in javascript is to set the expiry date to be in the past. Now this doesn’t actually delete the cookie, at least in Firefox. It just means the cookie will be deleted on browser close.

This is a problem for us: we have a product that involves archiving web pages from potentially many sites, with all this content stored on our server. And to make sure that pages render properly we include all js as well. However often cookies are set by js, and given that the page is cached on our server, these cookies are set under our domain.

So over time cookies from dozens of archived sites build up under our domain. And eventually the Cookie header exceeds the max content length, resulting in an HTTP 400 error code.

And because our clients are mostly in corporate environments they never reboot their machines or close their browsers: they can be left on for months. So this “soft” delete doesn’t work, at least not reliably.

Is there any way to physically remove cookies intra-session in javscript? Or alternatively, is there any way to stop them being set?

Answer 1

It’s not possible. Period. I’ve been struggling with this for several weeks without finding a solution.

Whoever invented the cookie getter/setter should be %insert_painful_punishment_here%.

Particularly Internet Exploder is a beast when it comes to deleting cookies. I can’t remember the exact issue, but I think it involved https and cookie names containing ;.

All I can offer is a workaround: Send a response body with your 400 response, something like ‘please restart your browser’.