Cookie expiration and security in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code regarding cookie expiration?

Consider the following PHP code snippet that sets a cookie. What will be the expiration time of the cookie relative to the current time?

PHP

<?php
setcookie('user', 'Alice', time() + 3600);
echo $_COOKIE['user'] ?? 'No cookie';
?>

A The cookie expires in 1 hour from now.

B The cookie expires immediately.

C The cookie expires in 3600 seconds from the Unix epoch (1970).

D The cookie never expires.

💡 Hint

Remember that time() returns the current Unix timestamp in seconds.

The third argument to setcookie is the expiration timestamp. Using time() + 3600 sets the cookie to expire 3600 seconds (1 hour) from now.

❓ Predict Output

intermediate

What will this PHP code output regarding cookie security flags?

Look at this PHP code that sets a cookie with security flags. What will be the effect of the 'secure' and 'httponly' flags?

PHP

<?php
setcookie('session', 'abc123', time() + 600, '/', '', true, true);
echo 'Cookie set';
?>

A The cookie is sent over HTTP and HTTPS and accessible to JavaScript.

B The cookie is sent only over HTTPS and is inaccessible to JavaScript.

C The cookie is sent only over HTTP and accessible to JavaScript.

D The cookie is sent over HTTPS but accessible to JavaScript.

💡 Hint

The last two boolean arguments in setcookie control 'secure' and 'httponly' flags.

The 'secure' flag (true) means the cookie is sent only over HTTPS. The 'httponly' flag (true) means JavaScript cannot access the cookie.

🔧 Debug

advanced

Why does this PHP cookie not expire as expected?

This PHP code tries to set a cookie that expires in 10 seconds, but the cookie never expires. What is the problem?

PHP

<?php
setcookie('temp', 'value', 10);
?>

A The cookie path is missing, causing the cookie to never expire.

B The expiration time should be a relative number, not an absolute timestamp.

C The cookie name is invalid, so expiration is ignored.

D The expiration time is set to 10 seconds after Unix epoch, which is in the past, so the cookie is deleted immediately.

💡 Hint

The expiration time must be a Unix timestamp in the future.

The third argument to setcookie must be a Unix timestamp. Using 10 means the cookie expires at 10 seconds after 1970, which is in the past, so the cookie is deleted immediately.

🧠 Conceptual

advanced

Which cookie attribute improves security by restricting cookie access to same-site requests?

Which cookie attribute helps prevent cross-site request forgery (CSRF) by restricting cookie sending to same-site requests only?

A SameSite

B Path

C Secure

D HttpOnly

💡 Hint

This attribute controls when cookies are sent with cross-site requests.

The SameSite attribute restricts cookies to be sent only with same-site requests, helping prevent CSRF attacks.

❓ Predict Output

expert

What is the output of this PHP code regarding cookie deletion?

This PHP code attempts to delete a cookie. What will be the output and effect?

PHP

<?php
setcookie('user', '', time() - 3600);
if (!isset($_COOKIE['user'])) {
    echo 'Cookie deleted';
} else {
    echo 'Cookie still exists';
}
?>

A Outputs 'Cookie deleted' because the cookie is removed immediately.

B Syntax error due to missing parameters in setcookie.

C Outputs 'Cookie still exists' because $_COOKIE is not updated until next request.

D Outputs nothing because headers cannot be sent after output.

💡 Hint

Remember that $_COOKIE reflects the cookies sent by the browser in the current request.

setcookie() sends a header to delete the cookie, but $_COOKIE is not updated until the next request, so the cookie still appears set in the current script.

Practice

1. What does setting the expires parameter in setcookie() control?

easy

A. How long the cookie stays on the user's browser

B. The name of the cookie

C. The value stored inside the cookie

D. The domain where the cookie is valid

Solution

1. Step 1: Understand the purpose of the expires parameter

   The expires parameter sets the time when the cookie will be deleted by the browser.

2. Step 2: Relate expires to cookie lifetime

   Setting expires controls how long the cookie remains stored on the user's device.

3. Final Answer:

   How long the cookie stays on the user's browser -> Option A

4. Quick Check:

   Cookie expiration = lifetime on browser [OK]

Hint: Expires means cookie lifetime in browser [OK]

Common Mistakes:

• Confusing expires with cookie name or value
• Thinking expires controls cookie content
• Mixing expires with domain or path

2. Which of the following is the correct way to set a cookie with secure and HttpOnly flags in PHP?

easy

A. setcookie('user', 'John', time() + 3600, '/', '', true, false);

B. setcookie('user', 'John', time() + 3600, '/', '', false, true);

C. setcookie('user', 'John', time() + 3600, '/', '', true, true);

D. setcookie('user', 'John', time() + 3600, '/', true, true);

Solution

1. Step 1: Recall setcookie() parameters order

   The parameters are: name, value, expire, path, domain, secure, httponly.

2. Step 2: Identify correct secure and httponly flags

   Setting secure to true means cookie sent only over HTTPS, and httponly true means inaccessible to JavaScript.

3. Final Answer:

   setcookie('user', 'John', time() + 3600, '/', '', true, true); -> Option C

4. Quick Check:

   Secure and HttpOnly flags = true, true [OK]

Hint: Secure is 6th, HttpOnly is 7th parameter in setcookie [OK]

Common Mistakes:

• Mixing order of parameters
• Setting secure or httponly to false by mistake
• Omitting parameters causing errors

3. What will be the output of this PHP code?

setcookie('test', '123', time() - 3600);
if(isset($_COOKIE['test'])) { echo 'Cookie set'; } else { echo 'Cookie not set'; }

medium

A. Cookie set

B. Cookie not set

C. Syntax error

D. Empty output

Solution

1. Step 1: Understand the expiration time used

   The cookie is set with an expiration time in the past (time() - 3600), which deletes the cookie immediately.

2. Step 2: Check if cookie exists after deletion

   Since the cookie is expired, $_COOKIE['test'] will not be set, so the else branch runs.

3. Final Answer:

   Cookie not set -> Option B

4. Quick Check:

   Expired cookie = not set [OK]

Hint: Past expiration deletes cookie, so isset returns false [OK]

Common Mistakes:

• Assuming cookie is set immediately after setcookie
• Ignoring expiration time meaning
• Confusing server and client cookie states

4. Identify the error in this PHP code snippet for setting a secure cookie:

setcookie('session', 'abc123', time() + 3600, '/', '', 'true', true);

medium

A. The secure flag is a string instead of boolean

B. The expiration time is in the past

C. The cookie name is invalid

D. Missing path parameter

Solution

1. Step 1: Check parameter types in setcookie()

   The secure parameter must be a boolean (true/false), not a string.

2. Step 2: Identify the incorrect usage

   Here, 'true' is a string, which PHP treats as true but is incorrect usage and can cause unexpected behavior.

3. Final Answer:

   The secure flag is a string instead of boolean -> Option A

4. Quick Check:

   Secure flag must be boolean, not string [OK]

Hint: Use true/false without quotes for flags [OK]

Common Mistakes:

• Using 'true' or 'false' as strings
• Forgetting to set secure flag for HTTPS
• Omitting required parameters

5. You want to set a cookie named auth that lasts exactly 2 hours, is only sent over HTTPS, and cannot be accessed by JavaScript. Which of the following is the best way to do this?

hard

A. setcookie('auth', 'token', time() + 3600, '/', '', true, false);

B. setcookie('auth', 'token', time() + 7200, '/', '', false, true);

C. setcookie('auth', 'token', time() + 7200, '/', '', true, false);

D. setcookie('auth', 'token', time() + 7200, '/', '', true, true);

Solution

1. Step 1: Calculate correct expiration time

   2 hours = 7200 seconds, so expiration should be time() + 7200.

2. Step 2: Set secure and httponly flags correctly

   Secure flag true ensures HTTPS only; httponly true prevents JavaScript access.

3. Step 3: Verify all parameters

   Path is '/', domain is default '', flags are true, true matching requirements.

4. Final Answer:

   setcookie('auth', 'token', time() + 7200, '/', '', true, true); -> Option D

5. Quick Check:

   2 hours + secure + httponly = setcookie('auth', 'token', time() + 7200, '/', '', true, true); [OK]

Hint: Use time()+7200, secure=true, httponly=true for 2hr secure cookie [OK]

Common Mistakes:

• Using wrong expiration time
• Not setting secure flag for HTTPS
• Leaving httponly false allowing JS access