PHP Cookies: Lifetime, Options, Security, and Deletion

Cookie Lifecycle

A cookie is a small name-value pair stored by the browser and sent with later matching requests. PHP sends cookie instructions in response headers.

Cookie values are client controlled. Use them for preferences or opaque identifiers, not as trusted authorization state or secret storage.

Set and Read Cookies

setcookie() must run before response output. A newly set cookie normally appears in $_COOKIE on the next request because $_COOKIE describes the current request.

Remember a Theme

<?php
setcookie('theme', 'dark', [
    'expires' => time() + 60 * 60 * 24 * 30,
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

$theme = $_COOKIE['theme'] ?? 'light';

Secure cookies require HTTPS and will not be returned over plain HTTP.

Cookie Options

Option	Purpose
expires	Controls persistent lifetime; omit for a session cookie
path	Limits which URL paths receive the cookie
domain	Controls matching hosts; omit unless subdomain sharing is required
secure	Send only over HTTPS
httponly	Hide from browser JavaScript
samesite	Restrict cross-site sending behavior

Update and Delete

Updating means sending the same name, path, and domain with a new value. Deleting means sending matching scope attributes with an expiration in the past.

Delete the Theme Cookie

<?php
setcookie('theme', '', [
    'expires' => time() - 3600,
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

Cookie Failure Signals

Symptom	Check
Headers already sent	Output occurred before setcookie()
Cookie missing on localhost HTTP	Secure is true but the request is not HTTPS
Delete did not work	Path or domain differs from the original cookie
New value not in $_COOKIE immediately	It will arrive on the next matching request

Trust and Scope

SameSite reduces some cross-site requests but does not replace CSRF tokens for sensitive state changes. HttpOnly limits script access but does not stop the browser from sending the cookie. Secure protects transport only when every relevant request uses HTTPS.

A signed cookie can reveal its value while detecting changes; encryption is required when the value itself must be confidential. For authentication, prefer an opaque random identifier backed by server-side state rather than encoding permissions into a browser-controlled value.

Use a host-only cookie by omitting domain unless subdomain sharing is required.
The __Host- prefix requires Secure, path=/, and no Domain attribute.
Keep values small because matching cookies travel on every request.
Record consent before creating optional analytics or advertising cookies where applicable.

Cookie Scope Check

0 of 2 checked

Q1. When does a newly set cookie normally appear in $_COOKIE?

The next matching request Before setcookie() returns Only after a database query

Q2. Is a cookie value trusted authorization data?

Yes No Only if it is short

Cookie Security Failures

Authorization stored in plain text
Store trusted permissions on the server and send only an opaque identifier.
Deletion uses another path
Expire the cookie with the original name, path, and domain scope.
SameSite treated as CSRF protection
Use a server-validated CSRF token for sensitive requests.

Try this next

Trace Cookie Scope

0 of 2 completed

Set a language preference
Create a 30-day cookie with explicit path, Secure, HttpOnly, and SameSite options.
Diagnose deletion
List the attributes that must match when expiring the preference cookie.

Previous Next

PHP Cookies: Lifetime, Options, Security, and Deletion

Cookie Lifecycle

Set and Read Cookies

Remember a Theme

Cookie Options

Update and Delete

Delete the Theme Cookie

Cookie Failure Signals

Trust and Scope

Cookie Scope Check

Q1. When does a newly set cookie normally appear in $_COOKIE?

Q2. Is a cookie value trusted authorization data?

Cookie Security Failures

Authorization stored in plain text

Deletion uses another path

SameSite treated as CSRF protection

Trace Cookie Scope

Set a language preference

Diagnose deletion

Manage User State

PHP Resources

Popular Tutorials