up vote 1 down vote favorite
share [g+] share [fb]

I was trying to carrying out some cookie tests with a web site my colleagues are maintaining. In Windows Vista/IE8, cookies should be stored in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders registry key which points to C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies

Visiting regular open sites will result in new cookies landing in that directory. However, this particular site is SSL-based, and I do not see the cookies saved here. Where do SSL cookies get stored?

UPDATE

To provide better understanding of the situation, the core "problem" is the cookies of concern are non-persistent cookies, rather than being SSL-based. This causes the cookies to only remain within the memory space of the browser and thus does not get persisted to disk.

link|improve this question
69% accept rate
Are you able to disclose that site your are refering to? It could be the related cookie(s) might not be persistent and stored in the client browser memory. – o.k.w Feb 19 '10 at 2:40
yes there are two cookies used - one for app session (ASP.NET) and another for authentication (custom, not ASP.NET Forms authentication cookie). Both do not have expiry date set on them, which by default should mean they expire on browser close. By your explanation, it means this kind of cookies NEVER get saved to disk? – icelava Feb 19 '10 at 2:46
I'm not sure whether it is an IE only behavior, and I do not have concrete proof. Just my hunch that it makes sense to be stored in memory than as a file. – o.k.w Feb 19 '10 at 2:58
feedback

1 Answer

up vote 2 down vote accepted

I found a few articles on how non-persistent cookies are stored. In the memory it is.

Here's one of them: Back to Basics: Internet Cookies

Non-persistent cookies are stored in RAM and they get removed when the browser window instance is closed

Update:
I also did a test on accessing an SSL site after deleting all the site cookies. It does write to the same folder as you mentioned.

link|improve this answer
thanks. do you know how to manipulate (rather, delete) cookies in memory? – icelava Feb 19 '10 at 3:13
How do you want to manipulate other than clearing it? It's kind of a security issue if you are able to, don't you think? – o.k.w Feb 19 '10 at 3:15
the thing is i want to delete only the session cookie, while keeping the auth cookie intact. – icelava Feb 19 '10 at 4:07
Well, I have yet to know of any cookie 'maniuplator' for in-memory cookies. You can give this cookie util a try but I doubt it lets you manage non-file-based cookies. nirsoft.net/utils/iecookies.html – o.k.w Feb 19 '10 at 4:21
yes IECookiesView is based on the cookies folders :-/ – icelava Feb 19 '10 at 6:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.