Sometimes I turn cookies on to use a web site, but then forget to turn it off again and the result of this is that I get a blizzard of cookies until I notice and turn it off.

Can web sites that have gotten cookies onto my machine that way access those cookies even though I have the "Accept cookies from websites" button turned off as shown below:

enter image description here

In other words, I know that if I have this box unchecked my machine will not accept any NEW cookies from websites, but will it still return existing cookies to sites, even if no exception is created for them?


No, at least not if the browser is standards compliant.

Per RFC 6265 HTTP State Management Mechanism, if the browser offers the option to disable cookies, which the user selects, the browser must not include a Cookie header in Requests, and must ignore the Set-Cookie header in response objects.

That means that not only will a server be unable to set a cookie, even if it did, your browser would not serve it up when making a request to a site on the cookies path.

RFC 6265 HTTP State Management Mechanism April 2011

7.2. User Controls

User agents SHOULD provide users with a mechanism for managing the cookies stored in the cookie store. For example, a user agent might
let users delete all cookies received during a specified time period
or all the cookies related to a particular domain. In addition, many user agents include a user interface element that lets users examine
the cookies stored in their cookie store.

User agents SHOULD provide users with a mechanism for disabling
cookies. When cookies are disabled, the user agent MUST NOT include
a Cookie header in outbound HTTP requests and the user agent MUST NOT process Set-Cookie headers in inbound HTTP responses.

Some user agents provide users the option of preventing persistent storage of cookies across sessions. When configured thusly, user
agents MUST treat all received cookies as if the persistent-flag were set to false. Some popular user agents expose this functionality via "private browsing" mode [Aggarwal2010].

Some user agents provide users with the ability to approve individual writes to the cookie store. In many common usage scenarios, these controls generate a large number of prompts. However, some privacy- conscious users find these controls useful nonetheless.

source https://tools.ietf.org/html/rfc6265#section-7.2 Page 28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.