Using cookies

Cookies are a mechanism allowing applications to maintain state on top of the stateless HTTP protocol.

Cowboy provides facilities for handling cookies. It is highly recommended to use them instead of writing your own, as the implementation of cookies can vary greatly between clients.

Cookies are stored client-side and sent with every subsequent request that matches the domain and path for which they were stored, including requests for static files. For this reason they can incur a cost which must be taken in consideration.

Also consider that, regardless of the options used, cookies are not to be trusted. They may be read and modified by any program on the user's computer, but also by proxies. You should always validate cookie values before using them. Do not store any sensitive information in cookies either.

When explicitly setting the domain, the cookie will be sent for the domain and all subdomains from that domain. Otherwise the current domain will be used. The same is true for the path.

When the server sets cookies, they will only be available for requests that are sent after the client receives the response.

Cookies are sent in HTTP headers, therefore they must have text values. It is your responsibility to encode any other data type. Also note that cookie names are de facto case sensitive.

Cookies can be set for the client session (which generally means until the browser is closed), or it can be set for a number of seconds. Once it expires, or when the server says the cookie must exist for up to 0 seconds, the cookie is deleted by the client. To avoid this while the user is browsing your site, you should set the cookie for every request, essentially resetting the expiration time.

Cookies can be restricted to secure channels. This typically means that such a cookie will only be sent over HTTPS, and that it will only be available by client-side scripts that run from HTTPS webpages.

Finally, cookies can be restricted to HTTP and HTTPS requests, essentially disabling their access from client-side scripts.

Setting cookies

By default, cookies you set are defined for the session.

You can also make them expire at a specific point in the future.

You can delete cookies that have already been set. The value is ignored.

You can restrict them to a specific domain and path. For example, the following cookie will be set for the domain and all its subdomains, but only on the path /account and all its subdirectories.

You can restrict the cookie to secure channels, typically HTTPS.

You can restrict the cookie to client-server communication only. Such a cookie will not be available to client-side scripts.

Cookies may also be set client-side, for example using Javascript.

Reading cookies

As we said, the client sends cookies with every request. But unlike the server, the client only sends the cookie name and value.

You can read the value of a cookie.

You can also get a default value returned when the cookie isn't set.

And you can obtain all cookies at once as a list of key/value tuples.


See also

Version select