Is it acceptable for user agents to modify cookies other than by instruction from the server?

Question

Using javascript or in a native iOS App it is possible to read and modify cookies.

The server generally sets these, but if both the server and the client modifies the values then it becomes a global shared mutable state across systems.

This feels bad.

In the RFC it does not mention user agents modifying cookies other than by predefined rules (e.g. Honoring cookie expiry). It also says in the summary about cookies:

… These header fields can be used by HTTP servers to store state at HTTP user agents

However it does not actually prohibit or explicitly advise against clients modifying cookies.

• Is it acceptable to modify cookies on a user agent?
• Are there any references or guidelines on this matter?

Answer 1

Here's one way to think of it:

It is impossible for the server to directly set a cookie. The server sends an HTTP header, which tells the client to set a cookie. It's the same way with JavaScript or hand-editing, because it is assumed that if the client can change the cookie, the server can't complain (unless the request is malicious).

EU law also explicitly gives the client the right to refuse cookies.

HTTP is stateless, and the cookie isn't part of the protocol itself. This isn't like whether the server should return a proper status code.

---

Maybe I'm not fully understanding your question, but why does it matter? It's common, accepted practice anyway. Googling "client modify cookie" returns nothing against it.

From Wikipedia:

Although cookies are usually set by the web server, they can also be set by the client using a scripting language such as JavaScript (provided the cookie's HttpOnly flag is not set).

Then skip down a bit:

HttpOnly cookie

HttpOnly cookies can only be used when transmitted via HTTP (or HTTPS). They are not accessible through non-HTTP APIs such as JavaScript. This restriction eliminates the threat of cookie theft via cross-site scripting (XSS), while leaving the threats of cross-site tracing (XCT) and cross-site request forgery (CSRF) intact.

---

Therefore, we can deduce that the appropriate question isn't whether it's acceptable, but whether we can.