CODEWITHSUNDEEP
phplaravellaravel-4
Eddy Freeman
Eddy Freeman

Reputation: 3309

Laravel Cookie Not Showing Up Via Javascript

I'm newbie learning laravel and have the following in my route file::

Route::get("/setcookie", function(){
    $cookie = Cookie::make("low-carb","almond cookie",30);
    return Redirect::to("getcookie")->withCookie($cookie);
});

Route::get("/getcookie", function(){
    $cookie = Cookie::get("low-carb");
    return View::make("getcookie")->withCookie($cookie);
});

I set a cookie and redirect to a different page. I want to be able to show the cookie via javascript dialog box in a view page. The "getcookie" view page looks like::

<html>
<body>
this is the cookie page
<script language="javascript">
    window.onload = showCookies;

    function showCookies(){

        alert("Cookie is: " + document.cookie);
       }

</script>
</body>
</html>

The only thing i see on the popup dialog box is "Cookie is". The value am expecting doesn't show up.

I know definitely that am doing something wrong because when i check the cookies in the chrome developer tools, i see for the "setcookie" route, the keys REQUEST COOKIE and RESPONSE_COOKIE (laravel_session and low-carb) both have values but for the "getcookie" route where it is redirected to, the REQUEST COOKIE key in chrome has both "laravel_session and low-carb" but the RESPONSE_COOKIE key only has the "laravel_session" and the "low-carb" key-value is missing.

What am i doing wrong?

Upvotes: 4

Views: 5936

Answers (1)

Rich Bradshaw
Rich Bradshaw

Reputation: 72975

By default Laravel cookies are marked as httponly - this means that they they can't be accessed via JS. This is often what you want, hence it being the default.

If you look at the source here: https://github.com/laravel/framework/blob/master/src/Illuminate/Cookie/CookieJar.php#L41, you'll see that the method signature looks like:

public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true)

where the last variable passed in is the httpOnly variable.

So, if you change from:

Cookie::make("low-carb","almond cookie",30);

to

Cookie::make("low-carb","almond cookie",30, null, null, false, false);

Then your cookie will not be marked as httponly, and will be accessible via JS.

You can check if a cookie httponly or not by using your browsers dev tools, in Chrome's Dev Tools go to Resources, then to Cookies, then to oyur domain, and there is a column in that table called HTTP - it has a Tick if that cookies is HTTPonly.

Edit: All cookies are encrypted and signed in Laravel, so that users can't tamper with them. Not 100% on this personally - $_SESSION is for persistent data that the user can't edit, $_COOKIE is for data that you want the user to be able to read and edit. Anyway, just use PHP's native:

setcookie("low-carb", "almond cookie", time()+(30*60));

instead of the laravel method if you want to do this.

You might also want to think whether there is a "better" way to deal with this - perhaps you don't need Cookies for this anyway (remember they are sent with every request that matches the cookie's path, CSS, JS, images, fonts - everything)

Upvotes: 9

Related Questions