Sections

Cookies Component


Cookies Management

Cookies are a very useful way to store small pieces of data on the client’s machine that can be retrieved even if the user closes his/her browser. Phalcon\Http\Response\Cookies acts as a global bag for cookies. Cookies are stored in this bag during the request execution and are sent automatically at the end of the request.

Basic Usage

You can set/get cookies by just accessing the cookies service in any part of the application where services can be accessed:

<?php

use Phalcon\Mvc\Controller;

class SessionController extends Controller
{
    public function loginAction()
    {
        // Chequeamos si la cookie esta previamente seteada
        if ($this->cookies->has('remember-me')) {
            // Obtenemos la cookie
            $rememberMeCookie = $this->cookies->get('remember-me');

            // Obtenemos el valor de la cookie
            $value = $rememberMeCookie->getValue();
        }
    }

    public function startAction()
    {
        $this->cookies->set(
            'remember-me',
            'some value',
            time() + 15 * 86400
        );

        $this->cookies->send();
    }

    public function logoutAction()
    {
        $rememberMeCookie = $this->cookies->get('remember-me');

        // Borramos la cookie
        $rememberMeCookie->delete();
    }
}

Encryption/Decryption of Cookies

By default, cookies are automatically encrypted before being sent to the client and are decrypted when retrieved from the user. This protection prevents unauthorized users to see the cookies’ contents in the client (browser). Despite this protection, sensitive data should not be stored in cookies.

You can disable encryption as follows:

<?php

use Phalcon\Http\Response\Cookies;

$di->set(
    'cookies',
    function () {
        $cookies = new Cookies();

        $cookies->useEncryption(false);

        return $cookies;
    }
);

If you wish to use encryption, a global key must be set in the service:

    <?php

    use Phalcon\Crypt;

    $di->set(
        'crypt',
        function () {
            $crypt = new Crypt();

            /**
             * Establecer el algoritmo cipher.
             *
             * El cifrado `aes-256-gcm' es el preferido, pero no se puede utilizar
             * hasta que la librería openssl este actualizada. Disponible desde PHP 7.1.
             *
             * El `aes-256-ctr' es posiblemente la mejor opción de algoritmo de cifrado
             * en estos días.
             */
            $crypt->setCipher('aes-256-ctr');

            /**
             * Estableciendo la clave de encriptado.
             *
             * La clave debe ser generado previamente de una manera criptográficamente segura.
             *
             * Bad key:
             * "le password"
             *
             * Better (but still unsafe):
             * "#1dj8$=dp?.ak//j1V$~%*0X"
             *
             * Good key:
             * "T4\xb1\x8d\xa9\x98\x054t7w!z%C*F-Jk\x98\x05\x5c"
             *
             * Use your own key. No copiar y pegar esta clave de ejemplo.
             */
            $key = "T4\xb1\x8d\xa9\x98\x054t7w!z%C*F-Jk\x98\x05\x5c";

            $crypt->setKey($key);

            return $crypt;
        }
    );

? Sending cookies data without encryption to clients including complex objects structures, resultsets, service information, etc. could expose internal application details that could be used by an attacker to attack the application. If you do not want to use encryption, we highly recommend you only send very basic cookie data like numbers or small string literals.