Cookie expiration and security in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the 'expires' attribute in a cookie do?

The 'expires' attribute sets the date and time when the cookie will be deleted by the browser. After this time, the cookie is no longer sent with requests.

beginner

What is the purpose of the 'Secure' flag in a cookie?

The 'Secure' flag ensures the cookie is only sent over HTTPS connections, protecting it from being sent over unencrypted HTTP.

intermediate

How does the 'HttpOnly' flag improve cookie security?

The 'HttpOnly' flag prevents JavaScript from accessing the cookie, reducing the risk of cross-site scripting (XSS) attacks stealing the cookie.

intermediate

What is the difference between 'expires' and 'max-age' attributes in cookies?

'expires' sets a fixed date/time for cookie expiration, while 'max-age' sets the lifetime in seconds from the current time. 'max-age' is newer and preferred for relative expiration.

intermediate

Why should you set the 'SameSite' attribute on cookies?

The 'SameSite' attribute restricts how cookies are sent with cross-site requests, helping to prevent cross-site request forgery (CSRF) attacks.

Which cookie attribute ensures the cookie is only sent over HTTPS?

A Secure

B HttpOnly

C SameSite

D Expires

The 'Secure' attribute makes sure the cookie is sent only over HTTPS connections.

What does the 'HttpOnly' flag prevent?

A Cross-site request forgery

B Cookie expiration

C Sending cookie over HTTP

D Access to the cookie via JavaScript

'HttpOnly' prevents JavaScript from accessing the cookie, protecting it from XSS attacks.

If you want a cookie to expire in 1 hour from now, which attribute is best to use?

A expires with a fixed date 1 hour later

B max-age set to 3600 seconds

C HttpOnly

D Secure

'max-age' sets the cookie lifetime in seconds from now, so 3600 means 1 hour.

What is the main security benefit of setting 'SameSite' to 'Strict'?

A Allows cookies to be accessed by JavaScript

B Makes cookies expire immediately

C Prevents cookies from being sent with cross-site requests

D Encrypts the cookie data

'SameSite=Strict' blocks cookies from being sent on cross-site requests, reducing CSRF risks.

Which PHP function is used to set a cookie with expiration and security flags?

A setcookie()

B cookie_set()

C set_cookies()

D cookie()

The PHP function 'setcookie()' is used to create cookies with options like expiration, Secure, and HttpOnly.

Explain how to set a cookie in PHP that expires in 2 hours and is secure and HttpOnly.

Think about the parameters of setcookie() including options array.

Describe why cookie security flags like Secure, HttpOnly, and SameSite are important.

Consider common web security threats related to cookies.