Cookies

Cookies are managed with a cookie jar that uses a prefixed format to isolate cookies by context that share common attributes. In addition to the usual parameters, the attribute Partitionedis also supported.

To set one or more cookies per jar, you must define a property and a value.


        use Inphinit\Experimental\Http\CookieJar;

        $jar1 = new CookieJar('jar1');
        $jar1->example = 1;
        $jar1->send();

        $jar2 = new CookieJar('jar2');
        $jar2->example = 2;
        $jar2->send();

When using the send method, headers like this will be sent in the response:


        Set-Cookie: jar1:example=1; Path=/; Expires=Sun, 04 Jan 2026 19:42:30 GMT
        Set-Cookie: jar2:example=2; Path=/; Expires=Sun, 04 Jan 2026 19:42:30 GMT

A basic example of how to set 3 cookies in the same jar:


        use Inphinit\Experimental\Http\CookieJar;

        $jar = new CookieJar('sample');

        // Sets the values for each cookie using the `__get()` magic method (values are converted to strings).
        $jar->foo = 1;
        $jar->bar = 2.5;
        $jar->baz = 'text';

        $jar->setExpires('+1 week');
        $jar->setHttpOnly(true);
        $jar->setPartitioned(true);

        $jar->send();

When using the send method, headers like this will be sent in the response:


        Set-Cookie: sample:foo=1; Path=/; HttpOnly; Partitioned; Secure; Expires=Sun, 04 Jan 2026 19:42:30 GMT
        Set-Cookie: sample:bar=2.5; Path=/; HttpOnly; Partitioned; Secure; Expires=Sun, 04 Jan 2026 19:42:30 GMT
        Set-Cookie: sample:baz=text; Path=/; HttpOnly; Partitioned; Secure; Expires=Sun, 04 Jan 2026 19:42:30 GMT

Retrieving values from cookies:

This method send()is only necessary when setting or updating a cookie; to obtain the value in subsequent requests, simply instantiate the cookie and use the magic properties:


        use Inphinit\Experimental\Http\CookieJar;

        $jar1 = new CookieJar('jar1');
        var_dump($jar1->example);

        $jar2 = new CookieJar('jar2');
        var_dump($jar2->example);

Deleting cookies:

In the following example, the cookies foo(in the jar it will be as sample:foo) and bar(in the jar it will be as sample:bar) will be removed, while a foonew cookie will be created or its value updated to 3:


        use Inphinit\Experimental\Http\CookieJar;

        $jar = new CookieJar('sample');

        $jar->foo = null;
        $jar->bar = null;
        $jar->baz = '3';

        $jar->send();

When using the method send(), headers like this will be sent in the response:


        Set-Cookie: sample:foo=_; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0
        Set-Cookie: sample:bar=_; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0
        Set-Cookie: sample:baz=3; Path=/; Expires=Sun, 04 Jan 2026 19:45:48 GMT

API

Use	Description
`setDomain($domain)`	Defines the host to which the cookie will be sent. Note: unlike previous specifications, leading periods in domain names ( `.example.com`) are ignored.
`setExpires(string $datetime)`	Indicates the maximum duration of cookies. Note: Accepts date and time descriptions in English (e.g., `'+1 day'`, `'last Monday'`).
`setHttpOnly(bool $enable)`	It prevents JavaScript from accessing the cookie, for example, through the property `document.cookie`.
`setPartitioned(bool $enable)`	Indicates that the cookie should be stored using partitioned storage. Note that if this option is set, the directive `Secure`will also be activated automatically when `send()`run.
`setPath(string $path)`	It indicates the path that must exist in the requested URL for the browser to send the Cookie header.
`setSameSite(int $mode)`	Controls whether or not a cookie is sent with requests between different websites.
`setSecure(bool $enable)`	This indicates that the cookie is sent to the server only when a request is made using the https scheme (except on localhost) and is therefore more resistant to man -in-the-middle attacks .

Constants

The following constants must be used with the method setSameSite():

Use	Description
`SAME_LAX`	We will only send cookies for requests originating from the same website that set the cookie and for cross-website requests that meet both of the following criteria. This would exclude, for example, requests made using the fetch API or requests for sub-resources of elements , `<img>`or `<script>`navigations within elements `<iframe>`. This would include requests made when the user clicks on a link in the context of top-level navigation from one site to another, or an assignment to `document.location`, or a submission from `<form>`.
`SAME_NONE`	Send the cookie for both "cross-site" and "same-site" requests.
`SAME_STRICT`	Only send cookies for requests originating from the same website that set the cookie.

Example:


          use Inphinit\Experimental\Http\CookieJar;

          $jar = new CookieJar('sample');

          ...

          $jar->setSameSite(CookieJar::SAME_STRICT);

          $jar->send();