Cookie expiration and security in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code regarding cookie expiration?

Consider the following PHP code snippet that sets a cookie. What will be the expiration time of the cookie relative to the current time?

PHP

<?php
setcookie('user', 'Alice', time() + 3600);
echo $_COOKIE['user'] ?? 'No cookie';
?>

A The cookie expires in 1 hour from now.

B The cookie expires immediately.

C The cookie expires in 3600 seconds from the Unix epoch (1970).

D The cookie never expires.

💡 Hint

Remember that time() returns the current Unix timestamp in seconds.

The third argument to setcookie is the expiration timestamp. Using time() + 3600 sets the cookie to expire 3600 seconds (1 hour) from now.

❓ Predict Output

intermediate

What will this PHP code output regarding cookie security flags?

Look at this PHP code that sets a cookie with security flags. What will be the effect of the 'secure' and 'httponly' flags?

PHP

<?php
setcookie('session', 'abc123', time() + 600, '/', '', true, true);
echo 'Cookie set';
?>

A The cookie is sent over HTTP and HTTPS and accessible to JavaScript.

B The cookie is sent only over HTTPS and is inaccessible to JavaScript.

C The cookie is sent only over HTTP and accessible to JavaScript.

D The cookie is sent over HTTPS but accessible to JavaScript.

💡 Hint

The last two boolean arguments in setcookie control 'secure' and 'httponly' flags.

The 'secure' flag (true) means the cookie is sent only over HTTPS. The 'httponly' flag (true) means JavaScript cannot access the cookie.

🔧 Debug

advanced

Why does this PHP cookie not expire as expected?

This PHP code tries to set a cookie that expires in 10 seconds, but the cookie never expires. What is the problem?

PHP

<?php
setcookie('temp', 'value', 10);
?>

A The cookie path is missing, causing the cookie to never expire.

B The expiration time should be a relative number, not an absolute timestamp.

C The cookie name is invalid, so expiration is ignored.

D The expiration time is set to 10 seconds after Unix epoch, which is in the past, so the cookie is deleted immediately.

💡 Hint

The expiration time must be a Unix timestamp in the future.

The third argument to setcookie must be a Unix timestamp. Using 10 means the cookie expires at 10 seconds after 1970, which is in the past, so the cookie is deleted immediately.

🧠 Conceptual

advanced

Which cookie attribute improves security by restricting cookie access to same-site requests?

Which cookie attribute helps prevent cross-site request forgery (CSRF) by restricting cookie sending to same-site requests only?

A SameSite

B Path

C Secure

D HttpOnly

💡 Hint

This attribute controls when cookies are sent with cross-site requests.

The SameSite attribute restricts cookies to be sent only with same-site requests, helping prevent CSRF attacks.

❓ Predict Output

expert

What is the output of this PHP code regarding cookie deletion?

This PHP code attempts to delete a cookie. What will be the output and effect?

PHP

<?php
setcookie('user', '', time() - 3600);
if (!isset($_COOKIE['user'])) {
    echo 'Cookie deleted';
} else {
    echo 'Cookie still exists';
}
?>

A Outputs 'Cookie deleted' because the cookie is removed immediately.

B Syntax error due to missing parameters in setcookie.

C Outputs 'Cookie still exists' because $_COOKIE is not updated until next request.

D Outputs nothing because headers cannot be sent after output.

💡 Hint

Remember that $_COOKIE reflects the cookies sent by the browser in the current request.

setcookie() sends a header to delete the cookie, but $_COOKIE is not updated until the next request, so the cookie still appears set in the current script.