ave-cms/help/en/helpers/Cookie.md

Cookie - working with cookies

App\Helpers\Cookie is a thin wrapper over setcookie/$_COOKIE.

use App\Helpers\Cookie;

---

Methods

###set($key, $value, $expire = 86400, $domain = '', $path = '/', $secure = false, $httpOnly = false, $sameSite = 'Lax') Set cookies. By default it lasts for a day. $expire — period in seconds from the current moment. $sameSite accepts Lax, Strict or None; unsafe the combination None without $secure=true automatically becomes Lax.

// на 30 дней, только https, недоступна из JS
Cookie::set('theme', 'dark', 3600 * 24 * 30, '', '/', true, true);

###get($key = null, $default = null) Read cookies; without $key - all cookies.

$theme = Cookie::get('theme', 'light');

has($key) - whether there is a cookie.

delete($key, $path = '/', $domain = '', $secure = null, $sameSite = 'Lax') - delete.

if (Cookie::has('mp_auth')) { ... }
Cookie::delete('theme');

---

Practice

• Host-only cookie (important on subdomains - so that the cookie does not “leak” to another host): leave $domain empty.
• httpOnly set for everything that does not need to be read from JS (sessions, tokens) - reduces the risk of theft via XSS.
• secure is required on combat https.
• SameSite=Lax is enabled by default and is suitable for session, actor and remember-cookie. None only use for truly cross-site script and always together with Secure.

// пример: персистентный вход
Cookie::set('mp_auth', $token, 3600 * 24 * 60, '', '/', true, true);