PHP Cookie Set Get Delete Secure

Ringkasan

Cookie menyimpan data kecil di sisi klien. Di PHP diatur via setcookie() dan dibaca dari $_COOKIE.

Konsep Dasar

• setcookie(name, value, expires, path, domain, secure, httponly).
• $_COOKIE['name'] membaca nilai.
• Hapus = setcookie(name, '', time()-3600).
• httponly=true cegah akses JS (XSS), secure=true hanya HTTPS.

Cara Kerja / Struktur

php

setcookie("theme", "dark", [
  "expires" => time() + 86400*30,
  "path" => "/",
  "secure" => true,
  "httponly" => true,
  "samesite" => "Lax"
]);
$theme = $_COOKIE['theme'] ?? 'light';

Catatan Implementasi

• setcookie() harus sebelum output apa pun.
• Jangan taruh data sensitif di cookie (bisa diubah user).
• samesite=Lax/Strict mitigasi CSRF.

Kesalahan Umum

• Baca $_COOKIE di request yang sama dengan setcookie (belum ada).
• Cookie tanpa httponly → rentan XSS theft.

Glosarium

• HttpOnly: cookie tak bisa dibaca JS.
• SameSite: batasan kirim cookie lintas situs.

Referensi

• PHP Session
• PHP Keamanan Dasar