Cookie expiration and security in PHP - Mini Project: Build & Apply

Cookie expiration and security

📖 Scenario: You are building a simple PHP web application that uses cookies to remember user preferences. To keep users safe and improve their experience, you need to set cookies with proper expiration times and security flags.

🎯 Goal: Create a PHP script that sets a cookie with a specific expiration time and security settings, then displays a message confirming the cookie is set.

📋 What You'll Learn

Create a cookie named user_preference with the value dark_mode.

Set the cookie to expire in 7 days.

Ensure the cookie is only sent over secure HTTPS connections.

Make the cookie inaccessible to JavaScript by setting the HttpOnly flag.

Display a confirmation message that the cookie is set.

💡 Why This Matters

🌍 Real World

Cookies are used in websites to remember user settings like themes or login status. Setting expiration and security flags helps protect user data and improve experience.

💼 Career

Web developers must know how to manage cookies securely to protect users from attacks like session hijacking and to comply with privacy standards.

1

Create the cookie with name and value

Write PHP code to create a cookie named user_preference with the value dark_mode.

PHP

<?php
// Create a cookie named user_preference with value dark_mode
// Your code here

Hint

Use the setcookie function with the first two parameters as the cookie name and value.

2

Add expiration time for the cookie

Modify the setcookie call to set the cookie to expire in 7 days using the time() function.

PHP

<?php
// Set cookie to expire in 7 days
// Your code here

Hint

Add the third parameter to setcookie as time() + 7 * 24 * 60 * 60 to set expiration 7 days from now.

3

Add security flags to the cookie

Update the setcookie call to include the secure flag set to true and the httponly flag set to true.

PHP

<?php
// Add secure and httponly flags to the cookie
// Your code here

Hint

Use the 4th to 7th parameters of setcookie to set path, domain, secure, and httponly flags respectively.

4

Display confirmation message

Write a print statement to display the message "Cookie 'user_preference' has been set with security flags.".

PHP

<?php
// Print confirmation message
// Your code here

Hint

Use print to show the exact message.

Practice

1. What does setting the expires parameter in setcookie() control?

easy

A. How long the cookie stays on the user's browser

B. The name of the cookie

C. The value stored inside the cookie

D. The domain where the cookie is valid

Solution

1. Step 1: Understand the purpose of the expires parameter

   The expires parameter sets the time when the cookie will be deleted by the browser.

2. Step 2: Relate expires to cookie lifetime

   Setting expires controls how long the cookie remains stored on the user's device.

3. Final Answer:

   How long the cookie stays on the user's browser -> Option A

4. Quick Check:

   Cookie expiration = lifetime on browser [OK]

Hint: Expires means cookie lifetime in browser [OK]

Common Mistakes:

• Confusing expires with cookie name or value
• Thinking expires controls cookie content
• Mixing expires with domain or path

2. Which of the following is the correct way to set a cookie with secure and HttpOnly flags in PHP?

easy

A. setcookie('user', 'John', time() + 3600, '/', '', true, false);

B. setcookie('user', 'John', time() + 3600, '/', '', false, true);

C. setcookie('user', 'John', time() + 3600, '/', '', true, true);

D. setcookie('user', 'John', time() + 3600, '/', true, true);

Solution

1. Step 1: Recall setcookie() parameters order

   The parameters are: name, value, expire, path, domain, secure, httponly.

2. Step 2: Identify correct secure and httponly flags

   Setting secure to true means cookie sent only over HTTPS, and httponly true means inaccessible to JavaScript.

3. Final Answer:

   setcookie('user', 'John', time() + 3600, '/', '', true, true); -> Option C

4. Quick Check:

   Secure and HttpOnly flags = true, true [OK]

Hint: Secure is 6th, HttpOnly is 7th parameter in setcookie [OK]

Common Mistakes:

• Mixing order of parameters
• Setting secure or httponly to false by mistake
• Omitting parameters causing errors

3. What will be the output of this PHP code?

setcookie('test', '123', time() - 3600);
if(isset($_COOKIE['test'])) { echo 'Cookie set'; } else { echo 'Cookie not set'; }

medium

A. Cookie set

B. Cookie not set

C. Syntax error

D. Empty output

Solution

1. Step 1: Understand the expiration time used

   The cookie is set with an expiration time in the past (time() - 3600), which deletes the cookie immediately.

2. Step 2: Check if cookie exists after deletion

   Since the cookie is expired, $_COOKIE['test'] will not be set, so the else branch runs.

3. Final Answer:

   Cookie not set -> Option B

4. Quick Check:

   Expired cookie = not set [OK]

Hint: Past expiration deletes cookie, so isset returns false [OK]

Common Mistakes:

• Assuming cookie is set immediately after setcookie
• Ignoring expiration time meaning
• Confusing server and client cookie states

4. Identify the error in this PHP code snippet for setting a secure cookie:

setcookie('session', 'abc123', time() + 3600, '/', '', 'true', true);

medium

A. The secure flag is a string instead of boolean

B. The expiration time is in the past

C. The cookie name is invalid

D. Missing path parameter

Solution

1. Step 1: Check parameter types in setcookie()

   The secure parameter must be a boolean (true/false), not a string.

2. Step 2: Identify the incorrect usage

   Here, 'true' is a string, which PHP treats as true but is incorrect usage and can cause unexpected behavior.

3. Final Answer:

   The secure flag is a string instead of boolean -> Option A

4. Quick Check:

   Secure flag must be boolean, not string [OK]

Hint: Use true/false without quotes for flags [OK]

Common Mistakes:

• Using 'true' or 'false' as strings
• Forgetting to set secure flag for HTTPS
• Omitting required parameters

5. You want to set a cookie named auth that lasts exactly 2 hours, is only sent over HTTPS, and cannot be accessed by JavaScript. Which of the following is the best way to do this?

hard

A. setcookie('auth', 'token', time() + 3600, '/', '', true, false);

B. setcookie('auth', 'token', time() + 7200, '/', '', false, true);

C. setcookie('auth', 'token', time() + 7200, '/', '', true, false);

D. setcookie('auth', 'token', time() + 7200, '/', '', true, true);

Solution

1. Step 1: Calculate correct expiration time

   2 hours = 7200 seconds, so expiration should be time() + 7200.

2. Step 2: Set secure and httponly flags correctly

   Secure flag true ensures HTTPS only; httponly true prevents JavaScript access.

3. Step 3: Verify all parameters

   Path is '/', domain is default '', flags are true, true matching requirements.

4. Final Answer:

   setcookie('auth', 'token', time() + 7200, '/', '', true, true); -> Option D

5. Quick Check:

   2 hours + secure + httponly = setcookie('auth', 'token', time() + 7200, '/', '', true, true); [OK]

Hint: Use time()+7200, secure=true, httponly=true for 2hr secure cookie [OK]

Common Mistakes:

• Using wrong expiration time
• Not setting secure flag for HTTPS
• Leaving httponly false allowing JS access