ASP Cookies
写 Cookie、读 Cookie、设置过期与路径、多值 Cookie。
写 Cookie
<%
Response.Cookies("theme") = "dark"
Response.Cookies("theme").Expires = DateAdd("d", 7, Date()) ' 7 天后过期
Response.Cookies("theme").Path = "/"
Response.Cookies("theme").Secure = False
%>
<!DOCTYPE html><html><body><p>主题已保存</p></body></html>Without Expires it is a session cookie that dies with the browser. Setting it persists to disk. Path defaults to the current directory, so pages elsewhere cannot read it.
读 Cookie
<%
Dim theme
theme = Request.Cookies("theme")
If theme = "" Then theme = "light"
Response.Write "当前主题：" & theme
%>当前主题：darkA missing cookie yields an empty string rather than an error, so If ... = "" is a safe check — unlike JavaScript's undefined.
多值 Cookie
<%
' 一个 Cookie 里存多个键
Response.Cookies("user")("name") = "Ada"
Response.Cookies("user")("role") = "admin"
Response.Cookies("user").Expires = DateAdd("d", 30, Date())
' 读
Response.Write Request.Cookies("user")("name") & "<br>"
Response.Write Request.Cookies("user")("role")
%>Ada
adminA multi-value cookie is one cookie whose value is name=Ada&role=admin. It saves against the per-domain cookie count but parses slightly slower and still hits the 4KB limit.
删除 Cookie
<%
Response.Cookies("theme").Expires = DateAdd("d", -1, Date())
Response.Cookies("theme").Path = "/"
%>Deleting means setting an expiry in the past. Path must match the original or the browser treats it as a different cookie and the delete fails — the usual cause of "cannot clear the login state".
role=admin in a cookie — changing it to role=user escalates privileges. Keep permissions in the session or database.Cookie 的局限
| Limit | Value |
|---|---|
| Size per cookie | 约 4KB |
| Cookies per domain | 约 50 个（浏览器不同） |
| Sent on every request | 是，浪费带宽 |
| User editable | 是 |
写 Cookie
<%
Response.Cookies("theme") = "dark"
Response.Cookies("theme").Expires = DateAdd("d", 7, Date()) ' 7 天后过期
Response.Cookies("theme").Path = "/"
Response.Cookies("theme").Secure = False
%>
<!DOCTYPE html><html><body><p>主题已保存</p></body></html>不设 Expires 时是会话 Cookie，关掉浏览器就没了。设了之后写到磁盘，重启浏览器还在。Path 不设默认为当前目录，其他目录的页面读不到。
读 Cookie
<%
Dim theme
theme = Request.Cookies("theme")
If theme = "" Then theme = "light"
Response.Write "当前主题：" & theme
%>当前主题：darkCookie 不存在时 Request.Cookies("x") 返回空串而不是报错，所以可以直接用 If ... = "" 判空。这与 JavaScript 的 undefined 不同，不会抛异常。
多值 Cookie
<%
' 一个 Cookie 里存多个键
Response.Cookies("user")("name") = "Ada"
Response.Cookies("user")("role") = "admin"
Response.Cookies("user").Expires = DateAdd("d", 30, Date())
' 读
Response.Write Request.Cookies("user")("name") & "<br>"
Response.Write Request.Cookies("user")("role")
%>Ada
admin多值 Cookie 在浏览器里是同一个 Cookie，值是 name=Ada&role=admin 这样的串。它省了 Cookie 数量上限，但解析稍慢，且同样受 4KB 限制。
删除 Cookie
<%
Response.Cookies("theme").Expires = DateAdd("d", -1, Date())
Response.Cookies("theme").Path = "/"
%>删除就是把过期时间设成过去。Path 必须与原 Cookie 一致，否则浏览器认为是另一个 Cookie，删除无效——「清不掉登录状态」基本都是这个原因。
role=admin 这类权限信息直接放 Cookie——改成 role=user 就能提权。权限必须存在服务端 Session 或数据库里。Cookie 的局限
| 限制 | 值 |
|---|---|
| 单个大小 | 约 4KB |
| 每域名数量 | 约 50 个（浏览器不同） |
| 每次请求都发 | 是，浪费带宽 |
| 用户可改 | 是 |