Cookie expiration and security in PHP - Step-by-Step Execution

Concept Flow - Cookie expiration and security

Start script

↓

Set cookie with name, value

↓

Set expiration time

↓

Set security flags (Secure, HttpOnly, SameSite)

↓

Send cookie to browser

↓

Browser stores cookie

↓

Cookie expires after set time or deleted if expired

↓

End script

This flow shows how a PHP script sets a cookie with expiration and security flags, sends it to the browser, which stores it until it expires.

Execution Sample

PHP

<?php
setcookie("user", "Alice", time() + 3600, "/", "", true, true);
?>

Sets a cookie named 'user' with value 'Alice' that expires in 1 hour, is secure and HttpOnly.

Execution Table

Step	Action	Parameter/Value	Effect
1	Call setcookie	name = 'user'	Prepare cookie named 'user'
2	Call setcookie	value = 'Alice'	Set cookie value to 'Alice'
3	Call setcookie	expire = current time + 3600	Cookie expires in 1 hour
4	Call setcookie	path = '/'	Cookie valid for entire domain
5	Call setcookie	domain = '' (default)	Cookie valid for current domain
6	Call setcookie	secure = true	Cookie sent only over HTTPS
7	Call setcookie	httponly = true	Cookie inaccessible to JavaScript
8	Send cookie header	Set-Cookie: user=Alice; expires=...; path=/; Secure; HttpOnly	Browser receives cookie
9	Browser stores cookie	Expires in 1 hour	Cookie saved until expiration
10	After 1 hour	Cookie expires	Browser deletes cookie
11	End	-	Script ends

💡 Cookie expires after 1 hour, browser deletes it automatically

Variable Tracker

Variable	Start	After setcookie call	After sending header	After expiration
name	-	user	user	-
value	-	Alice	Alice	-
expire	-	time()+3600	time()+3600	expired
path	-	/	/	-
domain	-	'' (default)	'' (default)	-
secure	-	true	true	-
httponly	-	true	true	-

Key Moments - 3 Insights

Why do we add time() + 3600 for expiration?

Because time() returns current time in seconds, adding 3600 sets expiration 1 hour later (see execution_table step 3).

What does setting 'secure' to true do?

It ensures the cookie is sent only over HTTPS connections, protecting it from being sent over insecure HTTP (see execution_table step 6).

Why use 'httponly' flag?

It prevents JavaScript from accessing the cookie, reducing risk of cross-site scripting attacks (see execution_table step 7).

Visual Quiz - 3 Questions

Look at the execution_table, what is the expiration time set to at step 3?

A Current time minus 3600 seconds

B No expiration time set

C Current time plus 3600 seconds

D Current time plus 60 seconds

💡 Hint

Check the 'expire' parameter in execution_table row 3

At which step does the cookie become inaccessible to JavaScript?

A Step 7

B Step 6

C Step 4

D Step 9

💡 Hint

Look for 'httponly' flag in execution_table

If 'secure' was set to false, what would change in the execution_table?

A Step 6 would say 'Cookie sent only over HTTPS'

B Step 6 would say 'Cookie sent over HTTP and HTTPS'

C Step 7 would be skipped

D Cookie would expire immediately

💡 Hint

Check the meaning of 'secure' flag in execution_table step 6

Concept Snapshot

PHP setcookie() sets a cookie with name, value, expiration time (seconds since epoch).
Expiration is set by adding seconds to current time (time()+seconds).
Secure flag ensures cookie sent only over HTTPS.
HttpOnly flag blocks JavaScript access.
Path and domain control cookie scope.
Browser deletes cookie after expiration automatically.

Full Transcript

This visual execution trace shows how PHP sets a cookie with expiration and security flags. The script calls setcookie with parameters: name 'user', value 'Alice', expiration time set to current time plus 3600 seconds (1 hour), path '/', secure flag true, and httponly flag true. Each step sets part of the cookie data. The browser receives the cookie header and stores the cookie. After 1 hour, the cookie expires and the browser deletes it automatically. The secure flag ensures the cookie is sent only over HTTPS, and httponly prevents JavaScript access, improving security. Variables like name, value, expire, secure, and httponly change as the script runs. Key moments clarify why expiration uses time()+3600, and why secure and httponly flags matter. The quiz tests understanding of expiration time, when httponly applies, and effects of changing secure flag.