Bird
Raised Fist0
PHPprogramming~5 mins

Cookie expiration and security in PHP - Time & Space Complexity

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Time Complexity: Cookie expiration and security
O(n)
Understanding Time Complexity

When setting cookies in PHP, it's important to understand how the time it takes to set cookies grows as you add more cookies or set complex options.

We want to see how the code's work changes when handling cookie expiration and security settings.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.


// Set multiple cookies with expiration and security options
$cookies = [
    ['name' => 'user', 'value' => 'Alice'],
    ['name' => 'session', 'value' => 'abc123'],
    ['name' => 'prefs', 'value' => 'dark_mode']
];

foreach ($cookies as $cookie) {
    setcookie($cookie['name'], $cookie['value'], time() + 3600, '/', '', true, true);
}

This code sets several cookies, each with an expiration time and security flags.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

  • Primary operation: The foreach loop that sets each cookie.
  • How many times: Once for each cookie in the array.
How Execution Grows With Input

Each cookie requires one call to setcookie, so the work grows directly with the number of cookies.

Input Size (n)Approx. Operations
33 calls to setcookie
1010 calls to setcookie
100100 calls to setcookie

Pattern observation: The number of operations grows evenly as the number of cookies increases.

Final Time Complexity

Time Complexity: O(n)

This means the time to set cookies grows in a straight line with the number of cookies you set.

Common Mistake

[X] Wrong: "Setting cookie expiration or security options makes the code slower in a complex way."

[OK] Correct: These options are just parameters in each call and do not add extra loops or repeated work; the main cost depends on how many cookies you set.

Interview Connect

Understanding how your code scales when managing cookies helps you write efficient web applications and shows you can think about performance in real situations.

Self-Check

"What if we nested the cookie-setting inside another loop that runs multiple times? How would the time complexity change?"

Practice

(1/5)
1. What does setting the expires parameter in setcookie() control?
easy
A. How long the cookie stays on the user's browser
B. The name of the cookie
C. The value stored inside the cookie
D. The domain where the cookie is valid

Solution

  1. Step 1: Understand the purpose of the expires parameter

    The expires parameter sets the time when the cookie will be deleted by the browser.

  2. Step 2: Relate expires to cookie lifetime

    Setting expires controls how long the cookie remains stored on the user's device.

  3. Final Answer:

    How long the cookie stays on the user's browser -> Option A

  4. Quick Check:

    Cookie expiration = lifetime on browser [OK]
Hint: Expires means cookie lifetime in browser [OK]
Common Mistakes:
  • Confusing expires with cookie name or value
  • Thinking expires controls cookie content
  • Mixing expires with domain or path
2. Which of the following is the correct way to set a cookie with secure and HttpOnly flags in PHP?
easy
A. setcookie('user', 'John', time() + 3600, '/', '', true, false);
B. setcookie('user', 'John', time() + 3600, '/', '', false, true);
C. setcookie('user', 'John', time() + 3600, '/', '', true, true);
D. setcookie('user', 'John', time() + 3600, '/', true, true);

Solution

  1. Step 1: Recall setcookie() parameters order

    The parameters are: name, value, expire, path, domain, secure, httponly.

  2. Step 2: Identify correct secure and httponly flags

    Setting secure to true means cookie sent only over HTTPS, and httponly true means inaccessible to JavaScript.

  3. Final Answer:

    setcookie('user', 'John', time() + 3600, '/', '', true, true); -> Option C

  4. Quick Check:

    Secure and HttpOnly flags = true, true [OK]
Hint: Secure is 6th, HttpOnly is 7th parameter in setcookie [OK]
Common Mistakes:
  • Mixing order of parameters
  • Setting secure or httponly to false by mistake
  • Omitting parameters causing errors
3. What will be the output of this PHP code?
setcookie('test', '123', time() - 3600);
if(isset($_COOKIE['test'])) { echo 'Cookie set'; } else { echo 'Cookie not set'; }
medium
A. Cookie set
B. Cookie not set
C. Syntax error
D. Empty output

Solution

  1. Step 1: Understand the expiration time used

    The cookie is set with an expiration time in the past (time() - 3600), which deletes the cookie immediately.

  2. Step 2: Check if cookie exists after deletion

    Since the cookie is expired, $_COOKIE['test'] will not be set, so the else branch runs.

  3. Final Answer:

    Cookie not set -> Option B

  4. Quick Check:

    Expired cookie = not set [OK]
Hint: Past expiration deletes cookie, so isset returns false [OK]
Common Mistakes:
  • Assuming cookie is set immediately after setcookie
  • Ignoring expiration time meaning
  • Confusing server and client cookie states
4. Identify the error in this PHP code snippet for setting a secure cookie:
setcookie('session', 'abc123', time() + 3600, '/', '', 'true', true);
medium
A. The secure flag is a string instead of boolean
B. The expiration time is in the past
C. The cookie name is invalid
D. Missing path parameter

Solution

  1. Step 1: Check parameter types in setcookie()

    The secure parameter must be a boolean (true/false), not a string.

  2. Step 2: Identify the incorrect usage

    Here, 'true' is a string, which PHP treats as true but is incorrect usage and can cause unexpected behavior.

  3. Final Answer:

    The secure flag is a string instead of boolean -> Option A

  4. Quick Check:

    Secure flag must be boolean, not string [OK]
Hint: Use true/false without quotes for flags [OK]
Common Mistakes:
  • Using 'true' or 'false' as strings
  • Forgetting to set secure flag for HTTPS
  • Omitting required parameters
5. You want to set a cookie named auth that lasts exactly 2 hours, is only sent over HTTPS, and cannot be accessed by JavaScript. Which of the following is the best way to do this?
hard
A. setcookie('auth', 'token', time() + 3600, '/', '', true, false);
B. setcookie('auth', 'token', time() + 7200, '/', '', false, true);
C. setcookie('auth', 'token', time() + 7200, '/', '', true, false);
D. setcookie('auth', 'token', time() + 7200, '/', '', true, true);

Solution

  1. Step 1: Calculate correct expiration time

    2 hours = 7200 seconds, so expiration should be time() + 7200.

  2. Step 2: Set secure and httponly flags correctly

    Secure flag true ensures HTTPS only; httponly true prevents JavaScript access.

  3. Step 3: Verify all parameters

    Path is '/', domain is default '', flags are true, true matching requirements.

  4. Final Answer:

    setcookie('auth', 'token', time() + 7200, '/', '', true, true); -> Option D

  5. Quick Check:

    2 hours + secure + httponly = setcookie('auth', 'token', time() + 7200, '/', '', true, true); [OK]
Hint: Use time()+7200, secure=true, httponly=true for 2hr secure cookie [OK]
Common Mistakes:
  • Using wrong expiration time
  • Not setting secure flag for HTTPS
  • Leaving httponly false allowing JS access
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard