Managing Cookies

Under HTTP protocol, a server or a script uses cookies to maintain state information on the client workstation. The Win32® Internet functions have implemented a persistent cookie database for this purpose. The Win32 Internet cookie functions are used to set cookies into and access cookies from the cookie database. For more information on HTTP cookies, see HTTP Cookies.

The Win32 Internet functions InternetSetCookie and InternetGetCookie can be used to manage cookies. Note that the implementation of these functions is evolving; be cautious when using them.

Using Cookie Functions

The following functions allow an application to create or retrieve cookies in the cookie database.

InternetGetCookie	Retrieves cookies for the specified URL and all its parent URLs.
InternetSetCookie	Sets a cookie on the specified URL.

Unlike most of the Win32 Internet functions, the cookie functions do not require a call to InternetOpen. Cookies that have an expiration date are stored in the windows\cookies directory. Cookies that don't have an expiration date are stored in memory and are available only to the process in which they were created.

Getting a Cookie

InternetGetCookie returns the cookies for the specified URL and all its parent URLs.

The following example demonstrates a call to InternetGetCookie.

char szURL[256];          // buffer to hold the URL
LPSTR lpszData = NULL;    // buffer to hold the cookie data
DWORD dwSize=0;           // variable to get the buffer size needed

// Insert code to retrieve the URL.

retry:

// The first call to InternetGetCookie will get the required 
// buffer size needed to download the cookie data.
if (!InternetGetCookie(szURL, NULL, lpszData, &dwSize))
{
// Check for an insufficient buffer error.
    if (GetLastError()== ERROR_INSUFFICIENT_BUFFER)
    {
        // Allocate the necessary buffer.
        lpszData = new char[dwSize];

        // Try the call again.
        goto retry;
    }
else
    {
        // Insert error handling code.
    }

}
else
{
    // Insert code to display the cookie data.

    // Release the memory allocated for the buffer.
    delete[]lpszData;
}

Setting a Cookie

InternetSetCookie is used to set a cookie on the specified URL. InternetSetCookie can create both persistent and session cookies.

Persistent cookies are cookies that have an expiration date. These cookies are stored in the windows\system directory.

Session cookies are stored in memory and can be accessed only by the process that created them.

The data for the cookie should be in the format:

NAME=VALUE

For the expiration date, the format must be:

DAY, DD-MMM-YYYY HH:MM:SS GMT

DAY is the three-letter abbreviation for the day of the week, DD is the day of the month, MMM is the three-letter abbreviation for the month, YYYY is the year, and HH:MM:SS is the time of the day in military time.

The following example demonstrates two calls to InternetSetCookie. The first call creates a session cookie and the second creates a persistent cookie.

BOOL bReturn;

// Create a session cookie.
bReturn = InternetSetCookie("http://www.adventure_works.com", NULL,
            "TestData = Test");

// Create a persistent cookie.
bReturn = InternetSetCookie("http://www.adventure_works.com", NULL,
             "TestData = Test; expires = Sat, 01-Jan-2000 00:00:00 GMT");