Cookie expiration and security in PHP - Step-by-Step Execution

Concept Flow - Cookie expiration and security

Start script

↓

Set cookie with name, value

↓

Set expiration time

↓

Set security flags (Secure, HttpOnly, SameSite)

↓

Send cookie to browser

↓

Browser stores cookie

↓

Cookie expires after set time or deleted if expired

↓

End script

This flow shows how a PHP script sets a cookie with expiration and security flags, sends it to the browser, which stores it until it expires.

Execution Sample

PHP

<?php
setcookie("user", "Alice", time() + 3600, "/", "", true, true);
?>

Sets a cookie named 'user' with value 'Alice' that expires in 1 hour, is secure and HttpOnly.

Execution Table

Step	Action	Parameter/Value	Effect
1	Call setcookie	name = 'user'	Prepare cookie named 'user'
2	Call setcookie	value = 'Alice'	Set cookie value to 'Alice'
3	Call setcookie	expire = current time + 3600	Cookie expires in 1 hour
4	Call setcookie	path = '/'	Cookie valid for entire domain
5	Call setcookie	domain = '' (default)	Cookie valid for current domain
6	Call setcookie	secure = true	Cookie sent only over HTTPS
7	Call setcookie	httponly = true	Cookie inaccessible to JavaScript
8	Send cookie header	Set-Cookie: user=Alice; expires=...; path=/; Secure; HttpOnly	Browser receives cookie
9	Browser stores cookie	Expires in 1 hour	Cookie saved until expiration
10	After 1 hour	Cookie expires	Browser deletes cookie
11	End	-	Script ends

💡 Cookie expires after 1 hour, browser deletes it automatically

Variable Tracker

Variable	Start	After setcookie call	After sending header	After expiration
name	-	user	user	-
value	-	Alice	Alice	-
expire	-	time()+3600	time()+3600	expired
path	-	/	/	-
domain	-	'' (default)	'' (default)	-
secure	-	true	true	-
httponly	-	true	true	-

Key Moments - 3 Insights

Why do we add time() + 3600 for expiration?

Because time() returns current time in seconds, adding 3600 sets expiration 1 hour later (see execution_table step 3).

What does setting 'secure' to true do?

It ensures the cookie is sent only over HTTPS connections, protecting it from being sent over insecure HTTP (see execution_table step 6).

Why use 'httponly' flag?

It prevents JavaScript from accessing the cookie, reducing risk of cross-site scripting attacks (see execution_table step 7).

Visual Quiz - 3 Questions

Look at the execution_table, what is the expiration time set to at step 3?

A Current time minus 3600 seconds

B No expiration time set

C Current time plus 3600 seconds

D Current time plus 60 seconds

💡 Hint

Check the 'expire' parameter in execution_table row 3

At which step does the cookie become inaccessible to JavaScript?

A Step 7

B Step 6

C Step 4

D Step 9

💡 Hint

Look for 'httponly' flag in execution_table

If 'secure' was set to false, what would change in the execution_table?

A Step 6 would say 'Cookie sent only over HTTPS'

B Step 6 would say 'Cookie sent over HTTP and HTTPS'

C Step 7 would be skipped

D Cookie would expire immediately

💡 Hint

Check the meaning of 'secure' flag in execution_table step 6

Concept Snapshot

PHP setcookie() sets a cookie with name, value, expiration time (seconds since epoch).
Expiration is set by adding seconds to current time (time()+seconds).
Secure flag ensures cookie sent only over HTTPS.
HttpOnly flag blocks JavaScript access.
Path and domain control cookie scope.
Browser deletes cookie after expiration automatically.

Full Transcript

This visual execution trace shows how PHP sets a cookie with expiration and security flags. The script calls setcookie with parameters: name 'user', value 'Alice', expiration time set to current time plus 3600 seconds (1 hour), path '/', secure flag true, and httponly flag true. Each step sets part of the cookie data. The browser receives the cookie header and stores the cookie. After 1 hour, the cookie expires and the browser deletes it automatically. The secure flag ensures the cookie is sent only over HTTPS, and httponly prevents JavaScript access, improving security. Variables like name, value, expire, secure, and httponly change as the script runs. Key moments clarify why expiration uses time()+3600, and why secure and httponly flags matter. The quiz tests understanding of expiration time, when httponly applies, and effects of changing secure flag.

Practice

1. What does setting the expires parameter in setcookie() control?

easy

A. How long the cookie stays on the user's browser

B. The name of the cookie

C. The value stored inside the cookie

D. The domain where the cookie is valid

Solution

1. Step 1: Understand the purpose of the expires parameter

   The expires parameter sets the time when the cookie will be deleted by the browser.

2. Step 2: Relate expires to cookie lifetime

   Setting expires controls how long the cookie remains stored on the user's device.

3. Final Answer:

   How long the cookie stays on the user's browser -> Option A

4. Quick Check:

   Cookie expiration = lifetime on browser [OK]

Hint: Expires means cookie lifetime in browser [OK]

Common Mistakes:

• Confusing expires with cookie name or value
• Thinking expires controls cookie content
• Mixing expires with domain or path

2. Which of the following is the correct way to set a cookie with secure and HttpOnly flags in PHP?

easy

A. setcookie('user', 'John', time() + 3600, '/', '', true, false);

B. setcookie('user', 'John', time() + 3600, '/', '', false, true);

C. setcookie('user', 'John', time() + 3600, '/', '', true, true);

D. setcookie('user', 'John', time() + 3600, '/', true, true);

Solution

1. Step 1: Recall setcookie() parameters order

   The parameters are: name, value, expire, path, domain, secure, httponly.

2. Step 2: Identify correct secure and httponly flags

   Setting secure to true means cookie sent only over HTTPS, and httponly true means inaccessible to JavaScript.

3. Final Answer:

   setcookie('user', 'John', time() + 3600, '/', '', true, true); -> Option C

4. Quick Check:

   Secure and HttpOnly flags = true, true [OK]

Hint: Secure is 6th, HttpOnly is 7th parameter in setcookie [OK]

Common Mistakes:

• Mixing order of parameters
• Setting secure or httponly to false by mistake
• Omitting parameters causing errors

3. What will be the output of this PHP code?

setcookie('test', '123', time() - 3600);
if(isset($_COOKIE['test'])) { echo 'Cookie set'; } else { echo 'Cookie not set'; }

medium

A. Cookie set

B. Cookie not set

C. Syntax error

D. Empty output

Solution

1. Step 1: Understand the expiration time used

   The cookie is set with an expiration time in the past (time() - 3600), which deletes the cookie immediately.

2. Step 2: Check if cookie exists after deletion

   Since the cookie is expired, $_COOKIE['test'] will not be set, so the else branch runs.

3. Final Answer:

   Cookie not set -> Option B

4. Quick Check:

   Expired cookie = not set [OK]

Hint: Past expiration deletes cookie, so isset returns false [OK]

Common Mistakes:

• Assuming cookie is set immediately after setcookie
• Ignoring expiration time meaning
• Confusing server and client cookie states

4. Identify the error in this PHP code snippet for setting a secure cookie:

setcookie('session', 'abc123', time() + 3600, '/', '', 'true', true);

medium

A. The secure flag is a string instead of boolean

B. The expiration time is in the past

C. The cookie name is invalid

D. Missing path parameter

Solution

1. Step 1: Check parameter types in setcookie()

   The secure parameter must be a boolean (true/false), not a string.

2. Step 2: Identify the incorrect usage

   Here, 'true' is a string, which PHP treats as true but is incorrect usage and can cause unexpected behavior.

3. Final Answer:

   The secure flag is a string instead of boolean -> Option A

4. Quick Check:

   Secure flag must be boolean, not string [OK]

Hint: Use true/false without quotes for flags [OK]

Common Mistakes:

• Using 'true' or 'false' as strings
• Forgetting to set secure flag for HTTPS
• Omitting required parameters

5. You want to set a cookie named auth that lasts exactly 2 hours, is only sent over HTTPS, and cannot be accessed by JavaScript. Which of the following is the best way to do this?

hard

A. setcookie('auth', 'token', time() + 3600, '/', '', true, false);

B. setcookie('auth', 'token', time() + 7200, '/', '', false, true);

C. setcookie('auth', 'token', time() + 7200, '/', '', true, false);

D. setcookie('auth', 'token', time() + 7200, '/', '', true, true);

Solution

1. Step 1: Calculate correct expiration time

   2 hours = 7200 seconds, so expiration should be time() + 7200.

2. Step 2: Set secure and httponly flags correctly

   Secure flag true ensures HTTPS only; httponly true prevents JavaScript access.

3. Step 3: Verify all parameters

   Path is '/', domain is default '', flags are true, true matching requirements.

4. Final Answer:

   setcookie('auth', 'token', time() + 7200, '/', '', true, true); -> Option D

5. Quick Check:

   2 hours + secure + httponly = setcookie('auth', 'token', time() + 7200, '/', '', true, true); [OK]

Hint: Use time()+7200, secure=true, httponly=true for 2hr secure cookie [OK]

Common Mistakes:

• Using wrong expiration time
• Not setting secure flag for HTTPS
• Leaving httponly false allowing JS access