Prevent cookie from being sent to the server?

[minnesotan]

My webmail application uses public key encryption, and does all encryption/decryption in Java on the client's machine. Public and private keys are generated from the user's password so that a given password will always generate the same key pair. The password and private key never leave the user's machine so there is no possibility that a third party (myself included) could intercept and read the user's message.

I'd like to give the user the option to remember his password and key pair in a cookie. However, if this results in the password and private key being sent to the server, it defeats the purpose. What I need is a cookie that can be set and read from JavaScript but which never gets sent to the server.

I think I could to this by funneling all http requests through a Java applet which could filter out the offending cookies, but that would be very ugly.

Does anyone know of a way to do this?

 

[BillyRayPreachersSon]

Setting a client-side cookie in JS should have no bearing on the server - and no data from it would be sent unless you explicitly send it.

Hope this helps,
Dan



Coedit Limited - Delivering standards compliant, accessible web solutions

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[minnesotan]

Thanks for the quick reply.

Am I missing something? If I have an onSubmit function for my form like this:

function onSubmit(){
document.cookie = "private_key=123456;";
return true;
}

then when the form is submitted the server receives "private_key=123456" in the cookie header. I don't want that. I do want to be able to read the cookie from Javascript on the user's browser.

If I used document.cookie = "private_key=123456; secure;"

and didn't use https, that would give me what I want - the cookie exists on the browser but is never transmitted to the server. But I want to use https so that won't work.

 

[BillyRayPreachersSon]

Hmm- I think I might have given you totally the wrong information there - so you might want to check it out further.

Dan



Coedit Limited - Delivering standards compliant, accessible web solutions

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]