Cookie Management

Cookies live in the browser and are sent with requests. CodeIgniter's cookie helper reads and writes them, while app/Config/Cookie.php controls the defaults.

Set a cookie

set_cookie('theme', 'dark', 3600);

The third argument is the lifetime in seconds. Pass 0 for a browser-session cookie.

Read a cookie

$theme = get_cookie('theme');

Treat cookie values as untrusted input. Validate and escape them like any request value.

Delete a cookie

delete_cookie('theme');

Security flags

Set secure defaults in app/Config/Cookie.php:

• secure: send only over HTTPS.
• httponly: hide the cookie from JavaScript.
• samesite: reduce cross-site request risk; Lax is a good default.
• path and domain: limit where the cookie is sent.

Cookies versus sessions

Use sessions for signed-in state and server-side data. Use cookies for small preferences that the server does not need to protect, such as a theme choice or a dismissed notice. Never store passwords, roles you trust without checking, or personal data in a cookie.

If a value must be tamper-proof, keep it on the server or sign it. A cookie is stored on the visitor's machine and can be edited.

Back to course overview · Previous: Tempdata · Next: Common Functions