manual/en/features.cookies.php

20150101_rev01 · COMPARED WITH 20140711_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE

Full text changes — 20140711_rev01 to 20150101_rev01

11PHP transparently supports HTTP cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the [setcookie()](http://php.net/manual/en/function.setcookie.php) or [setrawcookie()](http://php.net/manual/en/function.setrawcookie.php) function. Cookies are part of the HTTP header, so [setcookie()](http://php.net/manual/en/function.setcookie.php) must be called before any output is sent to the browser. This is the same limitation that [header()](http://php.net/manual/en/function.header.php) has. You can use the [output buffering functions](http://php.net/manual/en/ref.outcontrol.php) to delay the script output until you have decided whether or not to set any cookies or send any headers.
22
33Any cookies sent to you from the client will automatically be included into a [$\_COOKIE](http://php.net/manual/en/reserved.variables.cookies.php) auto-global array if [variables\_order](http://php.net/manual/en/ini.core.php) contains "C". If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name.
44
5Depending on [register\_globals](http://php.net/manual/en/ini.core.php), regular PHP variables can be created from cookies. However it's not recommended to rely on them as this feature is often turned off for the sake of security. $HTTP\_COOKIE\_VARS is also set in earlier versions of PHP when the [track\_vars](http://php.net/manual/en/ini.core.php) configuration variable is set. (This setting is always on since PHP 4.0.3.)
5Depending on [register\_globals](http://php.net/manual/en/ini.core.php), regular PHP variables can be created from cookies. However it's not recommended to rely on them as this feature is often turned off for the sake of security.
66
77For more details, including notes on browser bugs, see the [setcookie()](http://php.net/manual/en/function.setcookie.php) and [setrawcookie()](http://php.net/manual/en/function.setrawcookie.php) function.
88
993
1010
1111[**_Henry_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
1515`It is better to note not to attach your cookies to and IP and block the IP if it is different as some people use Portable Browsers which will remember the cookies. It is better to show a login screen instead if the IP does not correspond to the session cookie's IP.`
1616
17174
1818
1919[**_myfirstname at braincell dot cx_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
2020
21**10 years ago**
21**11 years ago**
2222
2323`[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]`
2424
2525`Just a general comment on Wilton's code snippet: It's generally considered very bad practice to store usernames and/or passwords in cookies, whether or not they're obsfucated. Many spyware programs make a point of stealing cookie contents.`
2626
2727`A much better solution would be to either use the PHP built in session handler or create something similar using your own cookie-based session ID. This session ID could be tied to the source IP address or can be timed out as required but since the ID can be expired separately from the authentication criteria the authentication itself is not compromised.`
2929`Stuart Livings`
3030
31313
3232
3333[**_ingen at stocken.ws_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
3434
35**7 years ago**
35**8 years ago**
3636
3737`If you want a secured session not tied to the client IP you can use the valid-for-one-query method below, but to safeguard against a scenario where the legitimate user clicks twice, you can use a shutdown function (register_shutdown_function)*.`
3838
3939`It will check to see if the script terminated prematurely (connection_aborted), and reset the valid session ID. That way, it's still valid when the user makes the second request. If the script ends properly, the new session ID will be used instead.`
4040
4141`Now, since you can't set a cookie from the shutdown function (after output has been sent), the cookie should contain both the previous valid session ID and the new one. Then the server script will determine (on the next request) which one to use.`
7777`IMPORTANT NOTE : This disables the ability of using the back button if you send the session ID via POST or GET.`
7878
7979\-5
8080
8181[**_bmorency at jbmlogic dot com_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
8282
83**8 years ago**
83**9 years ago**
8484
8585`In response to the solution posted in the comment below, there are some practical issues with this solution that must be kept in mind and handled by your code. I developed an application using a similar "use-it-once" key to manage sessions and it worked great but we got some complaints about legitimate users getting logged out without reasons. Turns out the problem was not tentative highjacking, it was either:`
8686
8787`A- Users double click on links or make 2 clicks very fast. The same key is sent for the 2 clicks because the new key from the first click didn't get to the browser on time for the second one but the session on the server did trash the key for the new one. Thus, the second click causes a termination of the session. (install the LiveHttpHeaders extension on firefox and look at the headers sent when you click twice very fast, you'll see the same cookie sent on both and the new cookie getting back from the server too late).`
8888
8989`B- For any given reason, the server experiences a slow down and the response with the new key (which has replaced the old one on the server) is not returned to the browser fast enough. The user gets tired of waiting and clicks somewhere else. He gets logged out because this second click send the old key which won't match the one you have on your server.`