js cookie safari

How to Enable JavaScript on Apple Safari (iPad, iPhone iOS)

Are you having a hard time in trying to turn on JavaScript on your iPad or Apple iPhone device?

JavaScript has evolved into an essential tool that makes the web what it is today. It controls the dynamic elements of web pages, and most websites will fail to run correctly if your Apple Safari browser does not have its JavaScript enabled. Although disabling JavaScript offers browsers faster loading of a website, you should know that it reduces the overall browsing experience on your iPad or iPhone device.

Be it an iPhone 11, iPhone 10 or MacOS device, the steps in this guide will help you learn the simple process and benefits of enabling the JavaScript feature on your Safari browser.

Instructions for Web Developers

You may want to consider linking to this site, to educate any script-disabled users on how to enable JavaScript in six most commonly used browsers. You are free to use the code below and modify it according to your needs.

On enablejavascript.io we optimize the script-disabled user experience as much as we can:

• The instructions for your browser are put at the top of the page
• All the images are inlined, full-size, for easy perusing

We want your visitors to have JavaScript enabled just as much as you do!

What Is JavaScript and Why Do I Need It?

JavaScript is a type of code used by web developers to install and establish interactive content on websites – in essence, it allows web pages to dynamically load and send content in the background without page loads on your Apple Safari browser. Generally, JavaScript is used by modern websites to provide various features such as display advertisements – the reason why a small subset of internet users want it disabled.

However, disabling the JavaScript feature on your Safari web browser is much more of a hassle than it seems. If you turn off JavaScript on your browser, many websites won’t function properly. In most cases, you will also be unable to enjoy certain functions or view content that you are accustomed to accessing on JavaScript-based websites.

How to Enable JavaScript on Safari ​

Here’s how to turn on JavaScript on Safari:

1. Select the “Safari” icon on your home screen.

2. Scroll down the Settings page to find the menu item labelled “Safari”, and then select it.

3. Scroll to the bottom of the Safari menu and choose “Advanced” – choosing this will reveal the advanced settings for your Safari browser.

4. On the Advanced menu, find the option for enabling or disabling “JavaScript” for your Safari browser. On finding the JavaScript option, you’ll see a button next to it.

5. Now slide this button to the right to turn on JavaScript on your Safari browser.

6. That’s it! You’ve just enabled JavaScript.

How to Disable JavaScript on Safari ​

Here’s how to turn off JavaScript on Safari:

1. Tap on the “Settings” icon on your home screen.

5. Now slide this button to the left to turn off JavaScript on your Safari browser.

6. That’s it! You’ve just disabled JavaScript. ​

How to Enable JavaScript on Mac

Follow the steps below to activate JavaScript in Safari on Mac:

1. Open the Safari application by clicking on an icon that appears like a compass in your bottom toolbar.

2. Click on the “Safari” menu at the top left corner of the browser.

3. Under the Safari menu, find and click on “Preferences”. This will open a pop-up menu.

4. Move your cursor over to the “Security” tab and select it.

5. Now check the box beside “Enable JavaScript” to turn on JavaScript. Make sure the box is checked.

6. You can now close the “Preferences” window to apply your settings.

7. That’s it! You’ve enabled JavaScript.

8. Restart your browser.

How to Disable JavaScript in Safari on Mac

Follow the steps below to disable JavaScript in Safari on Mac:

2. Click on “Safari” menu at the top left corner of the browser.

3. Under the Safari menu, find and click on “Preferences”. This will open a dropdown menu.

4. Move your cursor over to the “Security” tab and then click on it.

5. Now uncheck the box beside “Enable JavaScript” to disable JavaScript.

7. That’s it! You’ve disabled JavaScript.

8. Restart your browser. 

Apple Safari comes built-in with a JavaScript engine that makes website elements interactive. And while it isn't actually necessary that you enable it to use your Safari browser, it's something that you'll perhaps want to do to enjoy a seamless browsing experience. Otherwise, many websites you visit will appear broken or won't even work.

JavaScript is enabled by default in Apple Safari, but you can verify if yours is active through the Safari tab. To do this, simply click on "Safari" at the top left of your screen to expand the Menu. Next, click on Preferences to reveal the Safari Preferences section. Now that you're in the Preferences section, find and click the "Security" tab to access the "Enable JavaScript" checkbox. If the checkbox has a tick symbol, it means JavaScript is active and working.

Millions of websites use JavaScript to display interactive elements, such as animations, special effects and more. If you browse them with JavaScript disabled in your Apple Safari, then you probably won't have the full experience that you normally would. Some JavaScript-based websites may appear dull or static, while others may not even work at all.

Olumide is a longtime writer who started his career as a digital marketer before transitioning into a copywriter almost eight years ago.

• – Google Chrome
• – Internet Explorer
• – Microsoft Edge
• – Mozilla Firefox
• – Apple Safari

How to enable JavaScript in your browser and why http://www.enablejavascript.io/

• PRO Courses Guides New Tech Help Pro Expert Videos About wikiHow Pro Upgrade Sign In
• EDIT Edit this Article
• EXPLORE Tech Help Pro About Us Random Article Quizzes Request a New Article Community Dashboard This Or That Game Happiness Hub Popular Categories Arts and Entertainment Artwork Books Movies Computers and Electronics Computers Phone Skills Technology Hacks Health Men's Health Mental Health Women's Health Relationships Dating Love Relationship Issues Hobbies and Crafts Crafts Drawing Games Education & Communication Communication Skills Personal Development Studying Personal Care and Style Fashion Hair Care Personal Hygiene Youth Personal Care School Stuff Dating All Categories Arts and Entertainment Finance and Business Home and Garden Relationship Quizzes Cars & Other Vehicles Food and Entertaining Personal Care and Style Sports and Fitness Computers and Electronics Health Pets and Animals Travel Education & Communication Hobbies and Crafts Philosophy and Religion Work World Family Life Holidays and Traditions Relationships Youth
• Browse Articles
• Learn Something New
• Quizzes Hot
• Happiness Hub
• This Or That Game
• Train Your Brain
• Explore More
• Support wikiHow
• About wikiHow
• Log in / Sign up

How to Turn on Cookies and JavaScript: Quick & Easy Guide

Last Updated: September 11, 2024 Fact Checked

• Chrome (Desktop)
• Chrome (Mobile)
• Safari (Mac)
• Safari (iOS)
• Edge (Desktop)
• Edge (Mobile)
• Firefox (Desktop)
• Firefox (Mobile)

This article was co-authored by wikiHow staff writer, Nicole Levine, MFA . Nicole Levine is a Technology Writer and Editor for wikiHow. She has more than 20 years of experience creating technical documentation and leading support teams at major web hosting and software companies. Nicole also holds an MFA in Creative Writing from Portland State University and teaches composition, fiction-writing, and zine-making at various institutions. This article has been fact-checked, ensuring the accuracy of any cited facts and confirming the authority of its sources. This article has been viewed 910,839 times. Learn more...

Many websites use JavaScript to display content, and cookies to support features like login and online shopping. If a website isn't displaying properly, you can't use certain features, or you see an error like "enable JavaScript and cookies to continue," cookies and/or JavaScript are likely turned off. This wikiHow teaches you how to enable JavaScript and cookies in Chrome, Safari, Microsoft Edge, and Firefox on any device.

Quick Steps

• Click the menu in Chrome and go to Settings > Privacy and security .
• Select Allow third-party cookies .
• Go to Site Settings > Additional content settings > On-device site data .
• Select Allow sites to save data on your device and click the back button.
• Click JavaScript and select Sites can use JavaScript .

Google Chrome on a Computer

• This does not enable all cookies if you've disabled them. Google has moved this setting to a more hidden area, which we'll go to next.
• Click the back button when you're finished to return to the previous screen.

• Click the back button once to return to the previous page.

• You may also want to ensure there aren't any sites in the "Not allowed to use JavaScript" section in the lower half of this page.

Google Chrome for Android

• Cookies and Java are both enabled on Chrome for iPhone and iPad by default. There's no way to turn either on or off—they are both always on.
• Chrome no longer has a simple "Cookies" switch. Instead, your browser allows you to enable or disable third-party cookies (those that track you across websites) or enable/disable "on-device site data." If you want to enable the useful cookies, such as the ones that keep you signed in to websites, you'll want to enable "On-device site data."

• If you change this setting, tap the Back button to return to the previous menu.

• If the JavaScript switch was already blue or green, JavaScript was enabled, and no changes were necessary.

Safari on a Mac

• If you don't want websites to be able to track your browsing on other websites you visit, return to settings, click Privacy , and then select Prevent cross-site tracking . [3] X Research source

Safari on iPhone or iPad

Microsoft Edge on a Computer

• If you don't want websites to use cookies to track your browsing on other websites, toggle the "Block third-party cookies" switch to On as well.

• Check the "Block" list below the switch to make sure no sites you want to use are there. If you see a site you want to use JavaScript on, click the three dots next to its name and select Remove .

Microsoft Edge on Mobile

• Microsoft Edge for mobile devices doesn't give you an option to disable JavaScript. JavaScript is always on, so there's no need to enable it.

Firefox on a Computer

• JavaScript is permanently enabled on Firefox, but you can still change your cookie preferences.
• If you're encountering JavaScript errors in Firefox, uninstall and then reinstall Firefox.

• Alternatively, if you're using a Custom setting, you can just check the box next to "Cookies" to enable them.
• If you'd rather not allow cross-site cookies to track you, select Strict instead. This could make websites act a little differently than expected, so if you run into problems, return to this screen and select Standard instead.

Firefox for Mobile

• JavaScript is turned on by default in Firefox on Android and iOS—it's not possible to turn it on and off manually.

• If the "Strict" option is selected under "Protection Level," you won't receive cross-site cookies—this means that websites can't use cookies to track your browsing on other sites. If you're okay with these cross-site cookies, select Standard (default) instead.

Community Q&A

• Cookies are bits of data that websites save to your computer, allowing the sites to personalize your experience. JavaScript is a common that makes it possible for your web browser to display richer content. Thanks Helpful 0 Not Helpful 0
• Cookies may be either first-party or third-party. First-party cookies are cookies from the website you are visiting. Third-party cookies track you across several sites, allowing advertisers to target ads toward your preferences. Allowing third-party cookies is the default setting for most web browsers. Thanks Helpful 0 Not Helpful 0
• In most web browsers, both cookies and JavaScript are enabled by default; you really shouldn't have to enable them unless you or someone else have previously disabled them. Thanks Helpful 0 Not Helpful 0

You Might Also Like

• ↑ https://support.google.com/chrome/answer/14114868?sjid=15619355203945709572-NC&co=GENIE.Platform%3DAndroid&oco=1
• ↑ https://support.google.com/chrome/answer/95647
• ↑ https://support.apple.com/guide/safari/prevent-cross-site-tracking-sfri40732/17.0/mac/14.0
• ↑ https://support.mozilla.org/en-US/kb/websites-say-cookies-are-blocked-unblock-them

About This Article

If you're using Google Chrome on your PC or Mac, both JavaScript and cookies are enabled by default. If you're having trouble viewing or staying signed in to websites, you'll want to check your settings. In Chrome, click the three vertical dots at the top-right corner, and then select "Settings." Click "Privacy and Security" in the left panel. In the right panel, click "Cookies and site data." If you want to allow all cookies, select "Allow all cookies." You can also choose to allow most cookies while blocking tracking cookies from advertisers—to do this, select "Block third-party cookies." Now, click the back button in Chrome to return to your settings, and then click "Site Settings" in the right panel. Next, scroll down to the Content section and click "JavaScript" – If the switch is on and you see "Allowed (recommended)," JavaScript is turned on. If not, click the switch to enable it now. If you've blocked JavaScript for any websites, they'll appear under the "Block" header. You can unblock JavaScript on a website by clicking the three vertical dots next to the site's address and selecting "Remove." Your changes will take effect immediately. Did this summary help you? Yes No

• Send fan mail to authors

Reader Success Stories

May 10, 2017

Is this article up to date?

Featured Articles

Trending Articles

Watch Articles

• Computers and Electronics
• Internet Browsers
• Terms of Use
• Privacy Policy
• Do Not Sell or Share My Info
• Not Selling Info

wikiHow Tech Help Pro:

Level up your tech skills and stay ahead of the curve

Advisory boards aren’t only for executives. Join the LogRocket Content Advisory Board today →

• Product Management
• Solve User-Reported Issues
• Find Issues Faster
• Optimize Conversion and Adoption
• Start Monitoring for Free

A JavaScript developer’s guide to browser cookies

If you’re a JavaScript developer and you want to learn about browser cookies and what you can do with them, you’re at the right place. This article will cover how browser cookies work, how you can access and manipulate them both from the client and server, and how to control their visibility across browsers using their attributes.

What are cookies and how do they work?

A browser cookie is a small piece of data stored on a browser that’s created either by the client-side JavaScript or a server during an HTTP request. The browser can then send that cookie back with requests to the same server and/or let the client-side JavaScript of the webpage access the cookie when a user revisits the page.

Cookies are generally used for session management, personalization (such as themes or similar settings), and tracking user behavior across websites.

There was a time when cookies were used for all kinds of client-side storage, but there was an issue with this approach.

Since all domain cookies are sent with every request to the server on that domain, they can significantly affect performance, especially with low-bandwidth mobile data connections. For the same reason, browsers also typically set limits for cookie size and the number of cookies allowed for a particular domain (typically 4kb and 20 cookies per domain).

With the modern web, we got the new Web Storage APIs ( localStorage and sessionStorage ) for client-side storage, which allows browsers to store client-side data in the form of key-value pairs.

So, if you want to persist data only on the client-side, it’s better to use the APIs because they are more intuitive and easier to use than cookies and can store more data (usually up to 5MB).

Setting and accessing cookies

You can set and access cookies both via the server and the client. Cookies also have various attributes that decide where and how they can be accessed and modified. But, first, let’s look at how you can access and manipulate cookies on the client and server.

Client (browser)

The JavaScript that downloads and executes on a browser whenever you visit a website is generally called the client-side JavaScript. It can access cookies via the Document property cookie .

This means you can read all the cookies that are accessible at the current location with document.cookie . It gives you a string containing a semicolon-separated list of cookies in key=value format:

Similarly, to set a cookie, we must set the value of document.cookie . Setting the cookie is also done with a string in key=value format with the attributes separated by a semicolon:

Just so you’re not confused, the above statement does not override any existing cookies; it just creates a new one or updates the value of an existing one if a cookie with the same name already exists.

Now, I know this is not the cleanest API you have ever seen. That’s why I recommend using a wrapper or a library like js-cookie to handle client cookies:

Not only does it provide a clean API for CRUD operations on cookies, it also supports TypeScript , helping you avoid any spelling mistakes with the attributes.

The server can access and modify cookies via an HTTP request’s response and request headers. Whenever the browser sends an HTTP request to the server, it attaches all the relevant cookies to that site with the cookie header.

Check the request headers of almost any web app you use, and you’ll find the cookies sent to the server with request headers as a semicolon-separated string.

Over 200k developers use LogRocket to create better digital experiences

You can then read these cookies on the server from the request headers. For example, if you use Node.js on the server , you can read the cookies from the request object, like the snippet below, and get the semicolon-separated key=value pairs, similar to what we saw in the previous section:

Similarly, to set a cookie, you can add a Set-Cookie header with the response headers in key=value format with attributes separated by a semicolon, if any. This is how you can do it in Node.js:

Also, chances are you won’t use plain Node.js; instead, you can use it with a web framework like Express.js.

Accessing and modifying cookies gets much easier with Express by adding middleware . For reading, add cookie-parser to get all the cookies in the form of a JavaScript object with req.cookies . You can also use the built-in res.cookie() method that comes with Express for setting cookies:

And yes, all of this is supported with TypeScript, so there is no chance of typos on the server as well.

JavaScript cookie attributes

Now that you know how you can set and access cookies, let’s dive into the attributes of cookies.

Apart from name and value, cookies have attributes that control a variety of aspects that include cookie security, cookie lifetime, and where and how they can be accessed in a browser.

Domain attribute

According to MDN, the Domain attribute tells a browser which hosts are allowed to access a cookie. If unspecified, it defaults to the same host that set the cookie.

So, when accessing a cookie using client-side JavaScript, only the cookies that have the same domain as the one in the URL bar are accessible.

Similarly, only the cookies that share the same domain as the HTTP request’s domain are sent along with the request headers to the server.

Remember that having this attribute doesn’t mean you can set cookies for any domain because that would obviously be a huge security risk. (Imagine an attacker on evil.com modifying the cookies for your site, awesome.com, when the user visits their website.)

More great articles from LogRocket:

• Don't miss a moment with The Replay , a curated newsletter from LogRocket
• Learn how LogRocket's Galileo cuts through the noise to proactively resolve issues in your app
• Use React's useEffect to optimize your application's performance
• Switch between multiple versions of Node
• Discover how to use the React children prop with TypeScript
• Explore creating a custom mouse cursor with CSS
• Advisory boards aren’t just for executives. Join LogRocket’s Content Advisory Board. You’ll help inform the type of content we create and get access to exclusive meetups, social accreditation, and swag.

So, the only reason this attribute exists is to make the domain less restrictive and make the cookie accessible on subdomains.

For example, if your current domain is abc.xyz.com , and you don’t specify the domain attribute when setting a cookie, it would default to abc.xyz.com , and the cookies would only be restricted to that domain.

But, you might want the same cookie to be available on other subdomains as well. If this is the case, set Domain=xyz.com to make it available on other subdomains like def.xyz.com and the primary domain xyz.com .

However, this does not mean that you can set any domain value for cookies; top-level domains (TLDs) like .com and pseudo TLDs like .co.uk would be ignored by a well-secured browser.

Initially, browser vendors maintained lists of these public domains internally, which inevitably caused inconsistent behavior across browsers.

To tackle this, the Mozilla Foundation started a project called the Public Suffix List that records all public domains and shares them across vendors.

This list also includes services like github.io and vercel.app that restricts anyone from setting cookies for these domains, making abc.vercel.app and def.vercel.app count as separate sites with their own separate set of cookies.

Path attribute

The Path attribute specifies the path in the request URL that must be present to access the cookie. Apart from restricting cookies to domains, you can also restrict them via path. A cookie with the path attribute as Path=/store is only accessible on the /store path and its subpaths, /store/cart , /store/gadgets , and others.

Expires attribute

The Expires attribute sets an expiration date when cookies are destroyed. This can come in handy when you are using a cookie to check if the user saw an interstitial ad; you can set the cookie to expire in a month so the ad can show again after a month.

And guess what? It also removes cookies by setting the [Expires] date in the past .

Secure attribute

A cookie with the Secure attribute only sends to the server over the secure HTTPS protocol and never over the HTTP protocol (except on localhost). This helps prevent Man in the Middle attacks by making the cookie inaccessible over unsecured connections.

Unless you are serving your websites via an unsecured HTTP connection ( which you shouldn’t ) you should always use this attribute with all your cookies.

HttpOnly attribute

This attribute, as the name probably suggests, allows cookies to be only accessible via the server. So, only the server can set them via the response headers. If they are sent to the server with every subsequent request’s headers, they won’t be accessible via client-side JavaScript.

This can partially help secure cookies with sensitive information, like authentication tokens, from XSS attacks since any client-side script can’t read the cookies. But, remember it does not guarantee complete security from XSS attacks.

This is because if the attacker can execute third-party scripts on your website, they might not be able to access the cookies, and instead, can directly execute any relevant API requests to your server , causing the browser to readily attach your secure HttpOnly cookies with the request headers.

Imagine one of your users visits a page where a hacker injected their malicious script into your website. They can execute any API with that script and act on the user’s behalf without them ever knowing.

So, when people say that HttpOnly cookies cause XSS attacks to be useless, they are not completely correct because if a hacker can execute scripts on your website, you have much bigger problems to deal with. There are ways to prevent XSS attacks , but they are out of the scope of this article.

SameSite attribute

At the beginning of this article, we saw how cookies for a particular domain are sent with every request to the server for the corresponding domain.

This means that if your user visits a third-party site, and that site makes a request to APIs on your domain, then all the cookies for your domain will be sent with that request to your server. This can be both a boon and a curse depending on your use case.

This can be a boon in the case of something like YouTube embedding.

For example, if a user who is logged in to YouTube on their browser visits a third-party website containing YouTube embeds, they can click on the Watch Later button on the embedded video and add it to their library without leaving the current website.

This works because the browser sends the relevant cookies for YouTube to the server confirming their authentication status. These types of cookies are also called third-party cookies.

The curse this can cause is in basically any other use case you didn’t intend it to happen.

For instance, if a user visits a malicious website where that website makes a request to your server, and if the server doesn’t validate the request properly, then the attacker can take actions on the user’s behalf without their knowledge. This is basically a CSRF attack .

To help prevent this type of attack, the IETF proposed in 2016 a new attribute in cookies called SameSite . This attribute helps the above problem by allowing you to restrict your cookies to only a first-party context.

This means you should only attach cookies to the request when the domain in your URL bar matches the cookie’s domain.

There are three types of values you can set for the SameSite attribute: Strict , Lax , and None .

When set to Strict , your cookies will only be sent in a first-party context.

The Lax value is slightly less restrictive than Strict because it sends cookies with top-level navigations, meaning the cookie is sent to the server with the request for the page.

This is helpful in cases when a user clicks on your website from a Google search result or is redirected via a shortened URL.

Then None , as the name suggests, allows you to create third-party cookies by sending the relevant cookies with every request. This, however, is irrespective of the site user for cases like the YouTube embeds we discussed previously.

You can learn more about SameSite  cookies and how they behave with modern browsers in this post on web.dev.

Privacy and third-party cookies

We briefly explained third-party cookies in the previous section. In short, any cookie set by a site other than the one you are currently on is a third-party cookie.

You may have also heard about how infamous third-party cookies are for tracking you across websites and showing personalized ads. Now that you know the rules of cookies, you can probably guess how they might do it.

Basically, whenever a website uses a script or adds an embedded object via IFrame for third-party services, that third-party service can set a cookie for that service’s domain with HTTP response headers.

These cookies can also track you across websites that use the same third-party service embeds. And finally, the data collected by these third-party services by identifying you via cookies can then show you personalized ads.

To tackle this, many browsers like Firefox started blocking popular third-party tracking cookies via a new feature they call enhanced tracking protection (ETP) . Although this protects users from the 3000 most common identified trackers, its protection relies on the complete and up-to-date list.

Browsers are currently planning to eventually get rid of third-party cookies. Firefox is implementing state partitioning, which will result in every third-party cookie having a separate container for every website.

Now, you might think that something like state partitioning will also break legitimate use cases for third-party cookies apart from tracking, and you’re right.

So, browsers are working on a new API called Storage Access This API allows third-party context to request first-party storage access via asking users permission, which gives the service unpartitioned access to its first-party state. You can read about how it works in more detail on Mozilla’s blog .

I hope this article helped you learn something new about JavaScript cookies and gave you a brief overview of how they work, how they can be accessed and modified from the server and the client, and lastly, how the different attributes of cookies let you control their visibility and lifespan in the browser.

LogRocket : Debug JavaScript errors more easily by understanding the context

Debugging code is always a tedious task. But the more you understand your errors, the easier it is to fix them.

LogRocket allows you to understand these errors in new and unique ways. Our frontend monitoring solution tracks user engagement with your JavaScript frontends to give you the ability to see exactly what the user did that led to an error.

LogRocket records console logs, page load times, stack traces, slow network requests/responses with headers + bodies, browser metadata, and custom logs. Understanding the impact of your JavaScript code will never be easier!

Try it for free .

Share this:

• Click to share on Twitter (Opens in new window)
• Click to share on Reddit (Opens in new window)
• Click to share on LinkedIn (Opens in new window)
• Click to share on Facebook (Opens in new window)
• #vanilla javascript

Would you be interested in joining LogRocket's developer community?

Join LogRocket’s Content Advisory Board. You’ll help inform the type of content we create and get access to exclusive meetups, social accreditation, and swag.

Stop guessing about your digital experience with LogRocket

Recent posts:.

Nitro.js: Revolutionizing server-side JavaScript

Nitro.js is a solution in the server-side JavaScript landscape that offers features like universal deployment, auto-imports, and file-based routing.

How to display notification badges on PWAs using the Badging API

Ding! You got a notification, but does it cause a little bump of dopamine or a slow drag of cortisol? […]

JWT authentication: Best practices and when to use it

A guide for using JWT authentication to prevent basic security issues while understanding the shortcomings of JWTs.

Auth.js adoption guide: Overview, examples, and alternatives

Auth.js makes adding authentication to web apps easier and more secure. Let’s discuss why you should use it in your projects.

4 Replies to "A JavaScript developer’s guide to browser cookies"

Probably one of the best articles I have read! (in a long while)

Good job and great explanation of how cookies defer from Local- & session storage. Learned a lot of new concepts here including security vulnerabilities regarding cookies and how to properly use cookie attributes.

Thank you for this comprehensive article. Would you know if browsers, iOS Safari in particular, would start treating a cookie set in js as an http cookie if the server updates that cookie in a future request? For instance by changing the expiry date.

Such a nice post. Appreciate it 🙂

This article clarifies what I really would like to know. Thank you so much

Cookies, document.cookie

Cookies are small strings of data that are stored directly in the browser. They are a part of the HTTP protocol, defined by the RFC 6265 specification.

Cookies are usually set by a web server using the response Set-Cookie HTTP header. Then, the browser automatically adds them to (almost) every request to the same domain using the Cookie HTTP header.

One of the most widespread use cases is authentication:

• Upon sign-in, the server uses the Set-Cookie HTTP header in the response to set a cookie with a unique “session identifier”.
• Next time the request is sent to the same domain, the browser sends the cookie over the net using the Cookie HTTP header.
• So the server knows who made the request.

We can also access cookies from the browser, using document.cookie property.

There are many tricky things about cookies and their attributes. In this chapter, we’ll cover them in detail.

Reading from document.cookie

Does your browser store any cookies from this site? Let’s see:

The value of document.cookie consists of name=value pairs, delimited by ; . Each one is a separate cookie.

To find a particular cookie, we can split document.cookie by ; , and then find the right name. We can use either a regular expression or array functions to do that.

We leave it as an exercise for the reader. Also, at the end of the chapter, you’ll find helper functions to manipulate cookies.

Writing to document.cookie

We can write to document.cookie . But it’s not a data property, it’s an accessor (getter/setter) . An assignment to it is treated specially.

A write operation to document.cookie updates only the cookie mentioned in it and doesn’t touch other cookies.

For instance, this call sets a cookie with the name user and value John :

If you run it, you will likely see multiple cookies. That’s because the document.cookie= operation does not overwrite all cookies. It only sets the mentioned cookie user .

Technically, name and value can have any characters. To keep the valid formatting, they should be escaped using a built-in encodeURIComponent function:

There are a few limitations:

• You can only set/update a single cookie at a time using document.cookie .
• The name=value pair, after encodeURIComponent , should not exceed 4KB. So we can’t store anything huge in a cookie.
• The total number of cookies per domain is limited to around 20+, the exact limit depends on the browser.

Cookies have several attributes, many of which are important and should be set.

The attributes are listed after key=value , delimited by ; , like this:

• domain=site.com

A domain defines where the cookie is accessible. In practice though, there are limitations. We can’t set any domain.

There’s no way to let a cookie be accessible from another 2nd-level domain, so other.com will never receive a cookie set at site.com .

It’s a safety restriction, to allow us to store sensitive data in cookies that should be available only on one site.

By default, a cookie is accessible only at the domain that set it.

Please note, by default, a cookie is not shared with a subdomain, such as forum.site.com .

…But this can be changed. If we’d like to allow subdomains like forum.site.com to get a cookie set at site.com , that’s possible.

For that to happen, when setting a cookie at site.com , we should explicitly set the domain attribute to the root domain: domain=site.com . Then all subdomains will see such a cookie.

For example:

Historically, domain=.site.com (with a dot before site.com ) used to work the same way, allowing access to the cookie from subdomains. Leading dots in domain names are now ignored, but some browsers may decline to set the cookie containing such dots.

To summarize, the domain attribute allows to make a cookie accessible at subdomains.

• path=/mypath

The URL path prefix must be absolute. It makes the cookie accessible for pages under that path. By default, it’s the current path.

If a cookie is set with path=/admin , it’s visible on pages /admin and /admin/something , but not at /home , /home/admin or / .

Usually, we should set path to the root: path=/ to make the cookie accessible from all website pages. If this attribute is not set the default is calculated using this method .

expires, max-age

By default, if a cookie doesn’t have one of these attributes, it disappears when the browser/tab is closed. Such cookies are called “session cookies”

To let cookies survive a browser close, we can set either the expires or max-age attribute. max-Age has precedence if both are set.

• expires=Tue, 19 Jan 2038 03:14:07 GMT

The cookie expiration date defines the time when the browser will automatically delete it (according to the browser’s time zone).

The date must be exactly in this format, in the GMT timezone. We can use date.toUTCString to get it. For instance, we can set the cookie to expire in 1 day:

If we set expires to a date in the past, the cookie is deleted.

• max-age=3600

It’s an alternative to expires and specifies the cookie’s expiration in seconds from the current moment.

If set to zero or a negative value, the cookie is deleted:

The cookie should be transferred only over HTTPS.

By default, if we set a cookie at http://site.com , then it also appears at https://site.com and vice versa.

That is, cookies are domain-based, they do not distinguish between the protocols.

With this attribute, if a cookie is set by https://site.com , then it doesn’t appear when the same site is accessed by HTTP, as http://site.com . So if a cookie has sensitive content that should never be sent over unencrypted HTTP, the secure flag is the right thing.

This is another security attribute samesite . It’s designed to protect from so-called XSRF (cross-site request forgery) attacks.

To understand how it works and when it’s useful, let’s take a look at XSRF attacks.

XSRF attack

Imagine, you are logged into the site bank.com . That is: you have an authentication cookie from that site. Your browser sends it to bank.com with every request so that it recognizes you and performs all sensitive financial operations.

Now, while browsing the web in another window, you accidentally come to another site evil.com . That site has JavaScript code that submits a form <form action="https://bank.com/pay"> to bank.com with fields that initiate a transaction to the hacker’s account.

The browser sends cookies every time you visit the site bank.com , even if the form was submitted from evil.com . So the bank recognizes you and performs the payment.

This is a so-called “Cross-Site Request Forgery” (in short, XSRF) attack.

Real banks are protected from it of course. All forms generated by bank.com have a special field, a so-called “XSRF protection token”, that an evil page can’t generate or extract from a remote page. It can submit a form there, but can’t get the data back. The site bank.com checks for such a token in every form it receives.

Such a protection takes time to implement though. We need to ensure that every form has the required token field, and we must also check all requests.

Use cookie samesite attribute

The cookie samesite attribute provides another way to protect from such attacks, that (in theory) should not require “xsrf protection tokens”.

It has two possible values:

• samesite=strict

A cookie with samesite=strict is never sent if the user comes from outside the same site.

In other words, whether a user follows a link from their email, submits a form from evil.com , or does any operation that originates from another domain, the cookie is not sent.

If authentication cookies have the samesite=strict attribute, then an XSRF attack has no chance of succeeding, because a submission from evil.com comes without cookies. So bank.com will not recognize the user and will not proceed with the payment.

The protection is quite reliable. Only operations that come from bank.com will send the samesite=strict cookie, e.g. a form submission from another page at bank.com .

Although, there’s a small inconvenience.

When a user follows a legitimate link to bank.com , like from their notes, they’ll be surprised that bank.com does not recognize them. Indeed, samesite=strict cookies are not sent in that case.

We could work around that by using two cookies: one for “general recognition”, only to say: “Hello, John”, and the other one for data-changing operations with samesite=strict . Then, a person coming from outside of the site will see a welcome, but payments must be initiated from the bank’s website, for the second cookie to be sent.

• samesite=lax (same as samesite without value)

A more relaxed approach that also protects from XSRF and doesn’t break the user experience.

Lax mode, just like strict , forbids the browser to send cookies when coming from outside the site, but adds an exception.

A samesite=lax cookie is sent if both of these conditions are true:

The HTTP method is “safe” (e.g. GET, but not POST).

The full list of safe HTTP methods is in the RFC7231 specification . These are the methods that should be used for reading, but not writing the data. They must not perform any data-changing operations. Following a link is always GET, the safe method.

The operation performs a top-level navigation (changes URL in the browser address bar).

This is usually true, but if the navigation is performed in an <iframe> , then it is not top-level. Additionally, JavaScript methods for network requests do not perform any navigation.

So, what samesite=lax does, is to allow the most common “go to URL” operation to have cookies. E.g. opening a website link from notes that satisfy these conditions.

But anything more complicated, like a network request from another site or a form submission, loses cookies.

If that’s fine for you, then adding samesite=lax will probably not break the user experience and add protection.

Overall, samesite is a great attribute.

There’s a drawback:

• samesite is ignored (not supported) by very old browsers, the year 2017 or so.

So if we solely rely on samesite to provide protection, then old browsers will be vulnerable.

But we can use samesite together with other protection measures, like xsrf tokens, to add a layer of defence and then, in the future, when old browsers die out, we’ll probably be able to drop xsrf tokens.

This attribute has nothing to do with JavaScript, but we have to mention it for completeness.

The web server uses the Set-Cookie header to set a cookie. Also, it may set the httpOnly attribute.

This attribute forbids any JavaScript access to the cookie. We can’t see such a cookie or manipulate it using document.cookie .

This is used as a precautionary measure, to protect from certain attacks when a hacker injects his own JavaScript code into a page and waits for a user to visit that page. That shouldn’t be possible at all, hackers should not be able to inject their code into our site, but there may be bugs that let them do it.

Normally, if such a thing happens, and a user visits a web-page with a hacker’s JavaScript code, then that code executes and gains access to document.cookie with user cookies containing authentication information. That’s bad.

But if a cookie is httpOnly , then document.cookie doesn’t see it, so it is protected.

Appendix: Cookie functions

Here’s a small set of functions to work with cookies, more convenient than a manual modification of document.cookie .

There exist many cookie libraries for that, so these are for demo purposes. Fully working though.

getCookie(name)

The shortest way to access a cookie is to use a regular expression .

The function getCookie(name) returns the cookie with the given name :

Here new RegExp is generated dynamically, to match ; name=<value> .

Please note that a cookie value is encoded, so getCookie uses a built-in decodeURIComponent function to decode it.

setCookie(name, value, attributes)

Sets the cookie’s name to the given value with path=/ by default (can be modified to add other defaults):

deleteCookie(name)

To delete a cookie, we can call it with a negative expiration date:

Please note: when we update or delete a cookie, we should use exactly the same path and domain attributes as when we set it.

Together: cookie.js .

Appendix: Third-party cookies

A cookie is called “third-party” if it’s placed by a domain other than the page the user is visiting.

For instance:

A page at site.com loads a banner from another site: <img src="https://ads.com/banner.png"> .

Along with the banner, the remote server at ads.com may set the Set-Cookie header with a cookie like id=1234 . Such a cookie originates from the ads.com domain, and will only be visible at ads.com :

Next time when ads.com is accessed, the remote server gets the id cookie and recognizes the user:

What’s even more important is, when the user moves from site.com to another site other.com , which also has a banner, then ads.com gets the cookie, as it belongs to ads.com , thus recognizing the visitor and tracking him as he moves between sites:

Third-party cookies are traditionally used for tracking and ads services, due to their nature. They are bound to the originating domain, so ads.com can track the same user between different sites, if they all access it.

Naturally, some people don’t like being tracked, so browsers allow them to disable such cookies.

Also, some modern browsers employ special policies for such cookies:

• Safari does not allow third-party cookies at all.
• Firefox comes with a “black list” of third-party domains where it blocks third-party cookies.

If we load a script from a third-party domain, like <script src="https://google-analytics.com/analytics.js"> , and that script uses document.cookie to set a cookie, then such cookie is not third-party.

If a script sets a cookie, then no matter where the script came from – the cookie belongs to the domain of the current webpage.

Appendix: GDPR

This topic is not related to JavaScript at all, it is just something to keep in mind when setting cookies.

There’s a legislation in Europe called GDPR, that enforces a set of rules for websites to respect the users’ privacy. One of these rules is to require explicit permission for tracking cookies from the user.

Please note, that’s only about tracking/identifying/authorizing cookies.

So, if we set a cookie that just saves some information, but neither tracks nor identifies the user, then we are free to do it.

But if we are going to set a cookie with an authentication session or a tracking ID, then a user must allow that.

Websites generally have two variants of complying with GDPR. You are likely to have seen them both on the web:

If a website wants to set tracking cookies only for authenticated users.

To do so, the registration form should have a checkbox like “accept the privacy policy” (that describes how cookies are used), the user must check it, and then the website is free to set auth cookies.

If a website wants to set tracking cookies for everyone.

To do so legally, a website shows a modal “splash screen” for newcomers and requires them to agree to the cookies. Then the website can set them and let people see the content. That can be disturbing for new visitors though. No one likes to see such “must-click” modal splash screens instead of the content. But GDPR requires an explicit agreement.

GDPR is not only about cookies, it is about other privacy-related issues too, but that is beyond our scope.

document.cookie provides access to cookies.

• Write operations modify only the cookie mentioned in it.
• Name/value must be encoded.
• One cookie may not exceed 4KB in size. The number of cookies allowed on a domain is around 20+ (varies by browser).

Cookie attributes:

• path=/ , by default current path, makes the cookie visible only under that path.
• domain=site.com , by default a cookie is visible on the current domain only. If the domain is set explicitly, the cookie becomes visible on subdomains.
• expires or max-age sets the cookie expiration time. Without them, the cookie dies when the browser is closed.
• secure makes the cookie HTTPS-only.
• samesite forbids the browser to send the cookie with requests coming from outside the site. This helps to prevent XSRF attacks.

Additionally:

• The browser may forbid third-party cookies, e.g. Safari does that by default. There is also work in progress to implement this in Chrome.
• When setting a tracking cookie for EU citizens, GDPR requires to ask for permission.

Lesson navigation

• © 2007—2024  Ilya Kantor
• about the project
• terms of usage
• privacy policy

Use of document.cookie in Safari

Are there scoping issues with document.cookie in Safari?

I have written a javascript constructor function around document.cookie. The constructor function is defined in the global scope but is used inside of another object instance. It works in Firefox and Chrome but does not work in Safari.

If I do window.onload = function() { var ck = 'test=this; max-age=600; domain=localhost; path=/dev_lab_current/lab_56; SameSite=Lax'; document.cookie = ck; } it works. But it does not set the cookie in my html application. The application has a host object constructor that creates an instance of the cookie manager constructor within it. So it is about 2 scope levels deep. But the exact same code DOES work in Firefox and Chrome.

The html is designed to allow hard coded records to be kept for cookies created by it. PHP is used to write the hard coded records in a javascript source code file. For this reason I would not post a demo on my publically available web site.

Thank you for time and attention JK

I am answering my own post with an update: I solved the issue. The string used to set the cookie had syntax that Safari, and Opera would not allow.

That was due to a subtile and important issue with a for loop: a missing break statement.

So the difference between Safari (and Opera) and Firefox, Chrome is the cookie string syntax.

If secure is specified, it should be in the string by itself and not set to anything. The issue I tracked down was that 'secure=false;' was showing up in the string when it is just set by the presence of absence of 'secure'

• Latest Articles
• Top Articles
• Posting/Update Guidelines
• Article Help Forum

• View Unanswered Questions
• View All Questions
• View C# questions
• View C++ questions
• View Javascript questions
• View Visual Basic questions
• View .NET questions
• CodeProject.AI Server
• All Message Boards...
• Running a Business
• Sales / Marketing
• Collaboration / Beta Testing
• Work Issues
• Design and Architecture
• Artificial Intelligence
• Internet of Things
• ATL / WTL / STL
• Managed C++/CLI
• Objective-C and Swift
• System Admin
• Hosting and Servers
• Linux Programming
• .NET (Core and Framework)
• Visual Basic
• Web Development
• Site Bugs / Suggestions
• Spam and Abuse Watch
• Competitions
• The Insider Newsletter
• The Daily Build Newsletter
• Newsletter archive
• CodeProject Stuff
• Most Valuable Professionals
• The Lounge  
• The CodeProject Blog
• Where I Am: Member Photos
• The Insider News
• The Weird & The Wonderful
• What is 'CodeProject'?
• General FAQ
• Ask a Question
• Bugs and Suggestions

Cross-Domain Embedding: Making Third-Party Cookies Work Again

• Download source code - 16.6 KB

Introduction

Back in February of 2020, Google began rolling out their change to how third-party cookies are handled . This move was to help stop embedded cross-domain sites, often social media sites, from tracking your movement around the web without you knowing. There were two basic changes made:

• The cookie SameSite value now defaults to Lax instead of None
• If a value of None was explicitly set, then Secure must also be set

This caused most cross-domain embedded websites to no longer be able to use cookies, even those which are not malicious, as the browser began to block them.

The good news is it’s still possible to use third-party cookies from an embedded cross-domain website inside of an iframe. The bad news is it’s more difficult now, and Safari / iOS have additional steps using experimental APIs to make this work.

This article will go through the basics of getting this scenario working using an example node.js web host. The technology stack isn’t important though – any web host and language can accomplish the same.

The Old Way

The first thing we’re going to do is create a basic example that has 2 websites on different domains, with one embedded in the other in an iframe. To do this, we’re going to take advantage of the fact that localhost is treated as a different domain from 127.0.0.1 which means we can do all of this testing on our local machine. Hurrah.

To start, install node.js on your machine and some sort of IDE if you don’t already have them. In addition to node.js, we’ll also need express , a quick and easy web host package on top of node.js. It can be installed with npm install express when run from your working project directory.

First, we’ll make app.js which is the entry point for our two websites:

In addition, we’ll create two folders in the same directory, one named www for the top-level application, and another named www2 for the embedded application. In both directories, we’ll create an index.html as follows:

www/index.html

Www2/index.html.

And lastly, we’ll create some JavaScript to try and get the cookie, in this case, put in www2/scripts/index.js :

Finally, we’re ready to run this. It can be run using the command line: node app.js .

Once running, we can browse to http://localhost:3000/ which will show us:

Notice the text that the cookie cannot be found. This means our JavaScript could not find the cookie.

This is because we’re emitting the "old style" cookie with no SameSite and no Secure values. This can be seen if the Developer Tools are opened and the Document request is inspected:

The cookie is highlighted in yellow by the browser as it is being actively rejected. So how do we fix this?

The New Way – SameSite, Secure and HTTPS

In order to make this work, we must modify the cookie we’re sending to include SameSite=None to avoid the new default of Lax :

But this isn’t enough, and if you load the page like this, you’ll see the same problem – Developer Tools will show the SameSite=None , but still reject it:

This is because we also need to set the Secure value as per Google’s second change. The Secure value indicates the cookie should only be accepted over a secure HTTPS connection.

In order to get this to work, we must move the web application to HTTPS. To get HTTPS working locally, we can use self-signed certificates (this is just for development, after all). To do that, I followed this guide which helped immensely.

The first step is to generate self-signed SSL keys, which can be done with the openssl commands:

To make this easier, I’ve included generated self-signed keys already made inside of the project which are valid for one year.

Now we can modify the cookie to include both Secure and SameSite=None :

We’ll also need to modify our app.js file to support HTTPS instead of HTTP. The completed modified file looks like this:

And we’ll need to update the URL on the iframe in www/index.html :

Running this will create two HTTPS websites instead of HTTP ones.

However, if you browse to the outer website, https://localhost:3000/ , it will show a big scary red error with the text NET::ERR_CERT_INVALID because the certificate is not trusted:

To bypass this, both the inner and outer websites ( https://localhost:3000 and https://127.0.0.1:3001 ) must be opened at the top-level (in a tab), and " thisisunsafe " must be typed. After typing this magical phrase, the website will show:

It works! We can now send a cookie from our embedded website on a different domain to the client.

But there’s still a problem with Apple …

Safari on macOS and iOS

If you open this exact same website in Safari on macOS or iOS, you’ll see the following:

That’s right, it’s back to not working. This is because Safari won’t accept third-party cookies at all even with the new SameSite and Secure values set on the cookie. To make matters more frustrating, if you open the Developer Tools and inspect the response, there’s no cookie listed (and no reason for rejection):

Fortunately, this too can be solved using Safari’s experimental storage access API . The process is outlined in this webkit article , and it can be summed up as follows:

• In the embedded site, use the experimental document.hasStorageAccess() to determine if access is available to the cookie.
• If access is not available, have a button that, when pressed, will call document.requestStorageAccess() . This method will only work from a UI event (and will consume it).
• If the request fails, then the user either denied the request or has never opened the embedded website as a first-party website (and we must help them do that).

To implement this, we’re first going to add a button to www2/index.html :

Then we’re going to modify the JavaScript in www2/index.js to use the new experimental API by adding the following:

The process is simple: first check if the experimental API exists at all (it won’t outside of Safari), and if it does check for access, and if access isn’t there, then request it when the user clicks the button by opening a new page called requeststorageaccess.html .

The last step is to create this new page, requeststorageaccess.html :

With the following JavaScript to handle the button click inside requeststorageaccess.js :

We’re going back in the history here since we know we’d be re-directed from our main page. Now if we restart node and render this in Safari, we’ll see the following:

Clicking the ‘ Request ’ button will forward the user to the new page we created on the embedded domain:

Note the URL is our embedded URL, https://127.0.0.1:3001/ . This is important and the user would normally want to know what company exists on this URL. Once they know, they would (ideally) click the button to go back to where they came from, which will once again show the same page as above.

After returning, the user must click one more time on the ‘request’ button where they’ll finally receive a prompt from Safari:

Clicking ‘ Don’t Allow ’ will reject the Promise from requestStorageAccess() and ultimately lead us back to opening a page (because we don’t know why we got a rejection), while clicking ‘ Allow ’ will execute our code to reload the page and finally work:

And the cookie will also finally show up in Safari’s Development Tools:

As a developer note, once you accept the browser prompt to ‘ Allow ’, the only way to undo it is to clear the website data from Safari -> Preferences… -> Privacy -> Manage Website Data…

If you want to re-try this process, remove the data for the embedded URL and start the process again.

While it can be quite a bit of work, it’s still possible to have third-party cookies work in an embedded cross-domain website that’s inside of an iframe.

Even with Safari’s new restrictions, it can still be accomplished through their new experimental API.

The full source to run the completed project is available attached to this article and also in my github repository . The source includes packages.json which means you can run npm install in the directory to get the required packages followed by node app.js to run the application.

• 21 st April, 2022: Initial version

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Comments and Discussions

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

iPad User Guide

• iPad models compatible with iPadOS 18
• iPad mini (5th generation)
• iPad mini (6th generation)
• iPad (7th generation)
• iPad (8th generation)
• iPad (9th generation)
• iPad (10th generation)
• iPad Air (3rd generation)
• iPad Air (4th generation)
• iPad Air (5th generation)
• iPad Air 11-inch (M2)
• iPad Air 13-inch (M2)
• iPad Pro 11-inch (1st generation)
• iPad Pro 11-inch (2nd generation)
• iPad Pro 11-inch (3rd generation)
• iPad Pro 11-inch (4th generation)
• iPad Pro 11-inch (M4)
• iPad Pro 12.9-inch (3rd generation)
• iPad Pro 12.9-inch (4th generation)
• iPad Pro 12.9-inch (5th generation)
• iPad Pro 12.9-inch (6th generation)
• iPad Pro 13-inch (M4)
• Setup basics
• Make your iPad your own
• Keep in touch with friends and family
• Customize your workspace
• Do more with Apple Pencil
• Customize iPad for your child
• What’s new in iPadOS 18
• Turn on and set up iPad
• Wake, unlock, and lock
• Set up cellular service
• Connect to the internet
• Sign in and manage your Apple Account
• Subscribe to iCloud+
• Find settings
• Set up mail, contacts, and calendar accounts
• Learn the meaning of the status icons
• Charge the battery
• Show the battery percentage
• Check battery usage
• Use Low Power Mode to save battery life
• Read and bookmark the user guide
• Adjust the volume
• Learn basic gestures
• Learn advanced gestures
• Find and use your apps in App Library
• Switch between apps
• Zoom an app to fill the screen
• Quit and reopen an app
• Drag and drop
• Open two apps in Split View
• Switch an app window to Slide Over
• View an app’s windows and workspaces
• Multitask with Picture in Picture
• Move, resize, and organize windows
• Access features from the Lock Screen
• Perform quick actions
• Search on iPad
• Get information about your iPad
• View or change cellular data settings
• Travel with iPad
• Change or turn off sounds
• Create a custom Lock Screen
• Change the wallpaper
• Adjust the screen brightness and color balance
• Customize the text size and zoom setting
• Change the name of your iPad
• Change the date and time
• Change the language and region
• Add, edit, and remove widgets
• Move apps and widgets on the Home Screen
• Customize apps and widgets on the Home Screen
• Lock or hide an app
• Organize your apps in folders
• Remove or delete apps
• Use and customize Control Center
• Change your default web browser or email app
• Rotate your iPad screen
• View and respond to notifications
• Change notification settings
• Set up a focus
• Allow or silence notifications for a Focus
• Turn a Focus on or off
• Customize sharing options
• Type with the onscreen keyboard
• Dictate text
• Commands for dictating text
• Move the onscreen keyboard
• Select and edit text
• Use predictive text
• Use text replacements
• Add or change keyboards
• Add emoji, Memoji, and stickers
• Take a screenshot
• Take a screen recording
• Write and draw in documents
• Add text, shapes, stickers, and more
• Fill out forms, sign documents, and create signatures
• Interact with content in a photo or video
• Identify objects in your photos and videos
• Lift a subject from the photo background
• Take photos
• Take Live Photos
• Take a selfie
• Take a Portrait mode selfie
• Record videos
• Change advanced camera settings
• Adjust HDR camera settings
• View, share, and print photos
• Use Live Text
• Scan a QR code
• Scan documents
• Subscribe to Apple Arcade
• Play with friends in Game Center
• Connect a game controller
• Use App Clips
• Update apps
• View or cancel subscriptions
• Manage purchases, settings, and restrictions
• Install and manage fonts
• Buy books and audiobooks
• Annotate books
• Access books on other Apple devices
• Listen to audiobooks
• Set reading goals
• Organize books
• Create and edit events in Calendar
• Send invitations
• Reply to invitations
• Change how you view events
• Search for events
• Change Calendar settings
• Schedule or display events in a different time zone
• Keep track of events
• Use multiple calendars
• Use reminders in Calendar
• Use the Holidays calendar
• Share iCloud calendars
• Use the basic calculator
• Use the scientific calculator
• Solve math with Math Notes
• Work with graphs in Math Notes
• Convert units or currency
• See previous calculations
• See the world clock
• Set an alarm
• Use the stopwatch
• Add and use contact information
• Edit contacts
• Add your contact info
• Share Contacts on iPad
• Add or remove accounts
• Hide duplicate contacts
• Sync contacts across devices
• Import contacts
• Export contacts
• Get started with FaceTime
• Make FaceTime calls
• Receive FaceTime calls
• Create a FaceTime link
• Take a Live Photo
• Turn on Live Captions
• Use other apps during a call
• Make a Group FaceTime call
• View participants in a grid
• Use SharePlay to watch, listen, and play together
• Share your screen in a FaceTime call
• Request or give remote control in a FaceTime call
• Collaborate on a document in a FaceTime call
• Use video conferencing features
• Hand off a FaceTime call to another Apple device
• Change the FaceTime video settings
• Change the FaceTime audio settings
• Change your appearance
• Leave a call or switch to Messages
• Block a FaceTime call and report it as spam
• Modify files and folders
• Find files and folders
• Organize files and folders
• Send files from the Files app
• Set up iCloud Drive
• Share files and folders in iCloud Drive
• Transfer files from iPad to a storage device, a server, or the cloud
• Share your location
• Add or remove a friend
• Locate a friend
• Get notified when friends change their location
• Notify a friend when your location changes
• Add your iPad
• Get notified if you leave a device behind
• Locate a device
• Mark a device as lost
• Erase a device
• Remove a device
• Add an AirTag
• Share an AirTag or other item in Find My on iPad
• Add a third-party item
• Get notified if you leave an item behind
• Locate an item
• Mark an item as lost
• Remove an item
• Adjust map settings
• Turn off Find My
• Get started with Freeform
• Create a Freeform board
• Draw or handwrite
• Solve handwritten math problems
• Add text in sticky notes, shapes, and text boxes
• Add shapes, lines, and arrows
• Add diagrams
• Add photos, videos, and other files
• Apply consistent styles
• Position items on a board
• Navigate and present scenes
• Send a copy or PDF
• Print a board
• Share boards and collaborate
• Search Freeform boards
• Delete and recover boards
• Change Freeform settings
• Get started with Health
• Fill out your Health Details
• Intro to Health data
• View your health data
• Share your health data
• View health data shared by others
• Download health records
• View health records
• Log menstrual cycle information
• View menstrual cycle predictions and history
• Log a pregnancy
• Track your medications
• Learn more about your medications
• Log your state of mind
• Take a mental health assessment
• Customize your Sleep Focus
• Turn Sleep Focus on or off
• View your sleep history
• Check your headphone audio levels
• Use audiogram data
• Back up your Health data
• Intro to Home
• Upgrade to the new Home architecture
• Set up accessories
• Control accessories
• Control your home using Siri
• Use Grid Forecast to plan your energy usage
• View electricity usage and rates on iPad (participating U.S. providers only)
• Set up HomePod
• Control your home remotely
• Create and use scenes
• Use automations
• Set up security cameras
• Use Face Recognition
• Configure a router
• Invite others to control accessories
• Add more homes
• Get music, movies, and TV shows
• Get ringtones
• Manage purchases and settings
• Use iPad like a magnifying glass
• Customize controls
• Get descriptions of visual information around you
• Detect people around you
• Detect furniture around you
• Detect doors around you
• Detect text around you and have it read out loud
• Set up shortcuts for Live Recognition
• Add and remove email accounts
• Set up a custom email domain
• Check your email
• Unsend email with Undo send
• Reply to and forward emails
• Save an email draft
• Add email attachments
• Download email attachments
• Annotate email attachments
• Set email notifications
• Search for email
• Organize your email in mailboxes
• Flag or block emails
• Filter emails
• Use Hide My Email
• Use Mail Privacy Protection
• Change Mail settings
• Delete and recover emails
• Add a Mail widget to your Home Screen
• Print emails
• Use keyboard shortcuts
• Explore 3D maps
• Get travel directions
• Change or add stops to your route
• View a route overview or a list of turns
• Change settings for spoken directions
• Get driving directions
• Report traffic incidents
• Get cycling directions
• Get walking directions
• Save walks or hikes
• Get transit directions
• Get traffic and weather info
• Estimate travel time and ETA
• Download offline maps
• Search for places
• Add places and notes to your library
• Mark places with pins
• Share places
• Rate places and add photos
• Organize places with custom guides
• Find nearby attractions, restaurants, and services
• Get information about places
• Explore places with guides
• Look around places
• Take Flyover tours
• Clear location history
• Delete recent directions
• Choose a default travel mode and units
• Report an issue with Maps
• Measure dimensions
• View and save measurements
• Measure a person’s height
• Set up Messages
• About iMessage
• Send and reply to messages
• Unsend and edit messages
• Keep track of messages
• Forward and share messages
• Group conversations
• Watch, listen, or play together using SharePlay
• Share screens
• Collaborate on projects
• Use iMessage apps
• Take and edit photos or videos
• Share photos, links, and more
• Send stickers
• Create and send Memoji
• React with Tapbacks
• Style and animate messages
• Draw and handwrite messages
• Send and save GIFs
• Request, send, and receive payments
• Send and receive audio messages
• Turn read receipts on or off
• Change notifications
• Block, filter, and report messages
• Delete messages and attachments
• Recover deleted messages
• Subscribe to Apple Music
• Get personalized recommendations
• Mark items as favorites
• Add music and listen offline
• Create an Apple Music Profile
• Share music with friends
• See what friends are listening to
• Search for music
• Find music shared with you
• Find new music
• Use the music player controls
• Use Siri to play music
• Play lossless audio
• Play Spatial Audio
• Listen to radio
• Play music together using SharePlay
• Play music together in the car
• Adjust the sound
• Queue up your music
• Shuffle or repeat songs
• Apple Music Sing
• Show song credits and lyrics
• Tell Apple Music what you enjoy
• Intro to playlists
• Create, edit, and delete playlists
• Collaborate on a playlist
• Join a collaborative playlist
• Add a reaction to a collaborative playlist
• Get started with News
• Use News widgets
• See news stories chosen just for you
• Read and share stories
• Follow your favorite teams with My Sports
• Subscribe to Apple News+
• Browse and read Apple News+ stories
• Use Offline Mode to read downloaded News content
• Manually download Apple News+ issues
• Find puzzles in Apple News+
• Solve crossword and crossword mini puzzles
• Solve Quartiles puzzles
• Search for stories in News
• Save stories in News
• Clear your reading history in News
• Customize the News tab bar
• Subscribe to individual news channels
• Get started with Notes
• Create and format notes
• Use Quick Notes
• Add drawings and handwriting
• Enter formulas and equations
• Add photos, video, and more
• Record and transcribe audio
• Scan text and documents
• Work with PDFs
• Search notes
• Organize in folders
• Organize with tags
• Use Smart Folders
• Share and collaborate
• Export or print notes
• Change the Notes view
• Change Notes settings
• Use passwords on iPad
• Find your password for a website or app
• Change the password for a website or app
• Remove a password
• Recover a deleted password
• Create a password for a website or app
• Use passkeys to sign in to apps and websites
• Sign in with Apple
• Share passwords
• Automatically fill in strong passwords
• Change weak or compromised passwords
• View your passwords and related information
• Find your Wi-Fi password
• Share passwords securely with AirDrop
• Make your passwords available on all your devices
• Automatically fill in verification codes
• Sign in with fewer CAPTCHA challenges
• Use two-factor authentication
• Use security keys
• Delete, share, or copy a photo
• View and edit Photo Booth photos in the Photos app
• Get started with Photos
• View photos and videos
• See photo and video information
• Find photos and videos by date
• Find and name people and pets
• Find group photos
• Browse photos by location
• Find recently saved photos
• Find your travel photos
• Find receipts, QR codes, recently edited photos, and more
• Find photos, videos, and more by media type
• Customize the Photos app
• Filter and sort the photo library
• Back up and sync your photos with iCloud
• Delete or hide photos and videos
• Search for photos and videos
• Get wallpaper suggestions
• Watch memories
• Personalize your memories
• Play videos and slideshows
• Feature someone less
• Create Photo albums
• Edit and organize albums
• Filter and sort photos and videos in albums
• Share photos and videos
• Share long videos
• Create shared albums
• Add and remove people in a shared album
• Add and delete photos and videos in a shared album
• Set up or join an iCloud Shared Photo Library
• Use iCloud Shared Photo Library
• Add content to an iCloud Shared Photo Library
• Edit photos and videos
• Crop, rotate, flip, or straighten photos and videos
• Undo and revert photo edits
• Trim video length, adjust speed, and edit audio
• Edit Cinematic videos
• Edit Live Photos
• Edit portraits
• Make stickers from your photos
• Duplicate and copy photos and videos
• Merge duplicate photos
• Import and export photos and videos
• Print photos
• Find podcasts
• Listen to podcasts
• View podcast transcripts
• Follow your favorite podcasts
• Use the Podcasts widget
• Organize your podcast library
• Download, save, remove, and share podcasts
• Subscribe to podcasts
• Listen to subscriber-only content
• Change download settings
• Get started with Reminders
• Set reminders
• Make a grocery list
• Add details
• Complete and remove items
• Edit and organize a list
• Search your lists
• Organize multiple lists
• Use Smart Lists
• Print a list
• Work with templates
• Change Reminders settings
• Browse the web
• Search for websites
• See highlights
• Customize your Safari settings
• Change the layout
• Create multiple Safari profiles
• Open and close tabs
• Organize your tabs with Tab Groups
• View your tabs from another Apple device
• Share Tab Groups
• Use Siri to listen to a webpage
• Bookmark a website
• Bookmark a website as a favorite
• Save pages to a Reading List
• Find links shared with you
• Annotate and save a webpage as a PDF
• Automatically fill in forms
• Get extensions
• Hide distractions when browsing
• Hide distractions when reading
• Block pop-ups
• Clear your cache and cookies
• Enable cookies
• Browse the web privately
• Sign in with passkeys in Safari
• Check stocks
• Manage multiple watchlists
• Read business news
• Add earnings reports to your calendar
• Use a Stocks widget
• Translate text, voice, and conversations
• Translate text in apps
• Translate with the camera view
• Subscribe to Apple TV+, MLS Season Pass, or a channel
• Find shows, movies, and more
• Personalize the Home tab
• Buy, rent, or pre-order items
• Stream content and control playback
• Watch sports
• Watch multiple live sports streams
• Manage your library
• Add your TV provider
• Change the settings
• Make a recording
• View a transcription
• Play it back
• Edit or delete a recording
• Keep recordings up to date
• Organize recordings
• Search for or rename a recording
• Share a recording
• Duplicate a recording
• Check the weather
• Check the weather in other locations
• View weather maps
• Manage weather notifications
• Use Weather widgets
• Learn the weather icons
• Find out what Siri can do
• Tell Siri about yourself
• Have Siri announce calls and notifications
• Add Siri Shortcuts
• About Siri Suggestions
• Change Siri settings
• Set up Family Sharing
• Add Family Sharing members
• Remove Family Sharing members
• Share subscriptions
• Share purchases
• Share locations with family and locate lost devices
• Set up Apple Cash Family and Apple Card Family
• Set up parental controls
• Set up a child’s device
• Get started with Screen Time
• Protect your vision health with Screen Distance
• Set up Screen Time
• Set communication and safety limits and block nudity
• Set up Screen Time for a family member
• Set up Apple Pay
• Use Apple Pay in apps and on the web
• Use Apple Cash
• Use Apple Card
• Remove payment cards
• Change Wallet & Apple Pay settings
• Power adapter and charge cable
• Use AirPods
• Use EarPods
• Use headphone audio-level features
• Apple Pencil compatibility
• Pair and charge Apple Pencil (1st generation)
• Pair and charge Apple Pencil (2nd generation)
• Pair and charge Apple Pencil (USB-C)
• Pair and charge Apple Pencil Pro
• Enter text with Scribble
• Draw with Apple Pencil
• Take and mark up a screenshot with Apple Pencil
• Quickly write notes
• Wirelessly stream videos and photos to Apple TV or a smart TV
• Connect to a display with a cable
• HomePod and other wireless speakers
• iPad keyboards
• Switch between keyboards
• Enter characters with diacritical marks
• Use shortcuts
• Choose an alternative keyboard layout
• Change typing assistance options
• Connect Magic Trackpad
• Trackpad gestures
• Change trackpad settings
• Connect a mouse
• Mouse actions and gestures
• Change mouse settings
• External storage devices
• Connect Bluetooth accessories
• Play audio from your iPad on a Bluetooth accessory from your iPad
• Apple Watch with Fitness+
• Polishing cloth
• Work across devices using Continuity
• Use AirDrop to send items to nearby devices
• Hand off tasks between devices
• Cut, copy, and paste between iPad and other devices
• Stream video or mirror the screen of your iPad
• Allow phone calls and text messages on your iPad
• Share your internet connection with Personal Hotspot
• Use iPad as a webcam for Apple TV
• Insert sketches, photos, and scans on Mac
• Use iPad as a second display for Mac
• Use a keyboard and mouse or trackpad across your Mac and iPad
• Connect iPad and your computer with a cable
• Transfer files between devices
• Transfer files with email, messages, or AirDrop
• Transfer files or sync content with the Finder or iTunes
• Automatically keep files up to date with iCloud
• Get started with accessibility features
• Use accessibility features during setup
• Change Siri accessibility settings
• Quickly turn accessibility features on or off
• Overview of accessibility features for vision
• View a larger version of text you’re reading or typing
• Change display colors
• Make text easier to read
• Reduce onscreen motion
• Use iPad more comfortably while riding in a vehicle
• Customize per-app visual settings
• Hear what’s on the screen or typed
• Hear audio descriptions
• Turn on and practice VoiceOver
• Change your VoiceOver settings
• Use VoiceOver gestures
• Operate iPad when VoiceOver is on
• Control VoiceOver using the rotor
• Use the onscreen keyboard
• Write with your finger
• Keep the screen off
• Use VoiceOver with an external keyboard
• Use a braille display
• Type braille on the screen
• Customize gestures and keyboard shortcuts
• Use VoiceOver with a pointer device
• Get live descriptions of your surroundings
• Use VoiceOver in apps
• Overview of accessibility features for mobility
• Use AssistiveTouch
• Use an adjustable onscreen trackpad on iPad
• Control iPad with the movement of your eyes
• Adjust how iPad responds to your touch
• Auto-answer calls
• Change Face ID and attention settings
• Use Voice Control commands
• Adjust the top or Home button
• Use Apple TV Remote buttons
• Adjust pointer settings
• Adjust keyboard settings
• Control iPad with an external keyboard
• Adjust AirPods settings
• Adjust double tap and squeeze settings for Apple Pencil
• Intro to Switch Control
• Set up and turn on Switch Control
• Select items, perform actions, and more
• Control several devices with one switch
• Overview of accessibility features for hearing
• Use hearing devices
• Use Live Listen
• Use sound recognition
• Set up and use RTT
• Flash the indicator light for notifications
• Adjust audio settings
• Play background sounds
• Display subtitles and captions
• Show transcriptions for Intercom messages
• Get live captions of spoken audio
• Overview of accessibility features for speech
• Type to speak
• Record your personal voice
• Use Vocal Shortcuts
• Overview of cognitive accessibility features
• Lock iPad to one app
• Control what you share
• Set a passcode
• Set up Face ID
• Set up Touch ID
• Turn on Lock Screen features
• Keep your Apple Account secure
• Control app tracking permissions
• Control the location information you share
• Control access to information in apps
• Control access to contacts
• Control how Apple delivers advertising to you
• Control access to hardware features
• Create and manage Hide My Email addresses
• Protect your web browsing with iCloud Private Relay
• Use a private network address
• Use Advanced Data Protection
• Use Lockdown Mode
• Receive warnings about sensitive content
• Use Contact Key Verification
• Turn iPad on or off
• Force restart iPad
• Update iPadOS
• Back up iPad
• Reset iPad settings
• Restore all content from a backup
• Restore purchased and deleted items
• Sell, give away, or trade in your iPad
• Install or remove configuration profiles
• Important safety information
• Important handling information
• Find more resources for software and service
• FCC compliance statement
• ISED Canada compliance statement
• Apple and the environment
• Class 1 Laser information
• Disposal and recycling information
• Unauthorized modification of iPadOS
• ENERGY STAR compliance statement

Enable cookies on iPad

You can enable cookies. Some websites use cookies to keep track of your activity, such as your settings. Enabling cookies allows websites that require cookies to work normally.

Tap Advanced, then turn off Block All Cookies.

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications You must be signed in to change notification settings

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expire date in Safari not working #654

bidays commented Aug 4, 2020 • edited Loading

carhartl commented Aug 4, 2020

• 👍 5 reactions

Sorry, something went wrong.

No branches or pull requests

• Skip to main content
• Skip to search
• Skip to select language
• Sign up for free

Cookie Store API

Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers .

Note: This feature is available in Service Workers .

The Cookie Store API is an asynchronous API for managing cookies, available in windows and also service workers .

Concepts and Usage

The existing method of getting and setting cookies involves working with document.cookie as a string of key/value pairs. In addition to this being cumbersome and error prone, it also has a host of issues in the context of modern web development.

The document.cookie interface is synchronous , single-threaded, and blocking. When writing a cookie you must wait for the browser to update the string of all cookies. In addition, the reliance on document means that cookies cannot be accessed by service workers which cannot access the document object.

The Cookie Store API provides an updated method of managing cookies. It is asynchronous and promise-based, therefore does not block the event loop. It does not rely on document and so is available to service workers. The methods for getting and setting cookies also provide more feedback by way of error messages. This means that web developers do not have to set then immediately read back a cookie to check that setting was successful.

The CookieStore interface enables getting and setting cookies.

The CookieStoreManager interface provides a service worker registration to enable service workers to subscribe to cookie change events.

A CookieChangeEvent named change is dispatched against CookieStore objects in Window contexts when any script-visible cookies changes occur.

An ExtendableCookieChangeEvent named cookiechange is dispatched in ServiceWorkerGlobalScope contexts when any script-visible cookie changes occur that match the service worker's cookie change subscription list.

Extensions to other interfaces

Returns a reference to the CookieStore object associated with the service worker.

Returns a reference to the CookieStoreManager interface, which enables a web app to subscribe to and unsubscribe from cookie change events.

Returns a reference to the CookieStore object for the current document context.

Fired when any cookie changes have occurred which match the service worker's cookie change subscription list.

Specifications

Browser compatibility, api.cookiestore.

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

api.CookieStoreManager

• Service Worker API

It seems that your javascript is disabled. To view this site at it's best, please activate it!

• Foundation Board
• Executive Committee
• Vice President
• Director General
• Sport Movement
• Governments
• Permanent Special Committees
• Standing Committees
• Expert Advisory Groups
• Working Groups
• Management Team
• Strategic Plan
• Private Funding
• Headquarters
• Regional Offices
• President's Office
• Code Signatories
• Become a Code Signatory
• Code Review
• International Standards
• Code Compliance Implementation and Maintenance
• Compliance Monitoring Program
• Compliance Audits
• Compliance Enforcement Procedures
• Independent Observer Program
• Education Initiatives
• Education Committee
• Sport Values in Every Classroom
• Social Science Research
• Social Science Research Collaboration Platform
• Code Implementation Support Program
• Global Learning and Development Framework
• Global to Local
• Implementation
• Modules & Apps
• Anti-Doping I&I Project in Europe
• Legal Opinions and Articles on the Code
• NADO Program
• RADO Program
• Benchmarking for ADOs
• Laboratories
• Scientific Research
• Athlete Biological Passport
• Therapeutic Use Exemptions
• The Prohibited List
• Anti-Doping Process
• Anti-Doping Education
• Paris 2024 – Resources for athletes
• Athlete Engagement at events
• Athlete Council
• Anti-Doping Rights Act
• Speak Up - Report Doping
• Athletes' Anti-Doping Ombuds
• Provide Whereabouts
• Olympic & Paralympic Committees
• International Federations
• National Anti-Doping Organizations (NADOs)
• Regional Anti-Doping Organizations (RADOs)
• Major Event Organizations
• Court of Arbitration for Sport
• Law Enforcement
• Pharmaceutical Industry
• Service Providers
• Anti-Doping Statistics
• Scientific Research Projects
• Social Science Research Projects
• 2023 Annual Report

Releases 16 Sep 2024

WADA launches Call for Proposals for 2025 Social Science Research Grant Program

Deadline to submit applications is 18 November 2024 (12:00 noon GMT) 

Webinar for prospective applicants to be held on 2 October 

The World Anti-Doping Agency (WADA) is pleased to launch a Call for Proposals for its  2025 Social Science Research Grant Program  (Grant Program).  

Social science research (SSR) is an integral part of the anti-doping system. Using SSR to better understand doping as a human behavior helps support the prevention model that underpins the anti-doping system, which is built around rule of law, education, deterrence, detection, and enforcement. WADA is committed to SSR, demonstrated through its investment in the Grant Program since 2005 and the success of the 2020-2024 SSR Strategy . This commitment will continue into the future with the development of a new strategy already underway. 

The Grant Program is key to ensuring a continued investment in research so that anti-doping programs can be designed using an evidence-based approach. Through the Grant Program, WADA awards research grants to organizations of all types (such as universities, colleges, small businesses, for-profit, and not-for-profit organizations). 

Since 2005, WADA has invested more than USD 5 million in SSR grants for more than 150 projects .  

Research Priorities  

The SSR priorities are based on an athlete-centered model that identifies six overarching levels of influence with 12 priorities. Applicants’ primary research priority should be in line with WADA’s defined priorities, though it is possible to submit applications outside of these with a clear and strong rationale. The current SSR priorities are as follows: 

• Athlete pathway & experience 
• Clean Sport behaviors 
• Role and influence of athlete support personnel 
• Experience of athlete support personnel in Clean Sport 
• Effectiveness of anti-doping programs 
• Anti-doping policy impact 
• People investment 
• Prevention model 
• Evolution of sport practices 
• Sport policy 
• Non-sport influences 
• Horizon scanning 

More information on these research priorities can be found in the Overview & Guidance for Applicants . 

To submit an application 

We kindly ask applications to be submitted via the Agency’s WADA Grants platform by 18 November 2024 (12:00 noon GMT) . Please note that this deadline applies to all three Tiers of Investment. 

WADA seeks to enhance SSR capability in traditionally under-represented and underfunded regions—namely, Asia, Latin America, and Africa—and encourages researchers from these regions to apply. Please note that applications in French are also encouraged and accepted through the WADA Grants platform. 

Upcoming Webinar 

To support prospective applicants navigate the application process, WADA’s Education Team will be hosting a webinar on 2 October at 08:00 EST (in English). Register here .  

2025 Grant Program Timeline 

For further information regarding the 2025 Grant Program, please refer to the  Overview and Guidance for Applicants  and Frequently Asked Questions section of the WADA Grants platform; and/or, contact the Agency’s Education Department at  [email protected] .  

Latest news

WADA Executive Committee receives Independent Prosecuto...

WADA Executive Committee takes a number of decisions ai...