Member Avatar for paradox814

so I'm looking at the PHP docs for setcookie and this is what I see:

bool setcookie ( string name [, string value [, int expire [, string path [, string domain [, bool secure]]]]] )

they say if you want to have the cookie expire when the browser closes then do something like this:
setcookie("TestCookie", $value);

But I want this cookie to work on several subdomains no I need to fill in the domain part... is there any way around this in PHP?

  • 4 Contributors
  • 4 Replies
  • 899 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Lafinboy

Dani AI

Generated

Short answer: use PHP's session cookie and set its domain for all subdomains instead of trying to pass placeholders to setcookie() every time. That follows 's suggestion to use sessions but also lets the cookie remain a true session cookie (no persistent expiry) while being valid across subdomains. (php.net)

Use the session cookie options (call before sending output). Example (PHP 7.0+ supports passing options to session_start()): 

<?php
// run this before any output
session_start([
  'cookie_lifetime' => 0,         // session cookie (removed on browser close)
  'cookie_path' => '/',           
  'cookie_domain' => '.example.com', // parent domain so subdomains receive it
  'cookie_secure' => true,
  'cookie_httponly' => true,
  'cookie_samesite' => 'Lax',
]);

// normal session usage
$_SESSION['user_id'] = 123;
?>

Using session_set_cookie_params() before session_start() is the alternative if you prefer that API. Both approaches let PHP send a host-scoped session cookie that covers subdomains without you having to tinker with expires placeholders. (php.net)

A few important notes: RFC 6265 normalizes domain values (leading dot handling), but PHP docs and real-world practice commonly show '.example.com' for compatibility — browsers tolerate either form; do not try to set cookies for public-suffixes (like .com) and remember localhost behaves differently. Also, browser “session restore” can preserve session cookies across restarts, so “removed on close” is not absolute. (httpwg.org)

If subdomains run on different servers, share session storage (Redis/Memcached/DB) or use sticky sessions so the same session id maps to the same server-side data. Check that session.name and your session save handler/config are consistent across hosts. These are common gotchas after configuring the cookie domain. (php.net)

Summary tie-in: and were pointing out the placeholder/expire trick for setcookie() — that works — but using PHP session cookie settings is usually cleaner and safer when you want a non-persistent cookie available to multiple subdomains. (php.net)

Recommended Answers

All 4 Replies

Member Avatar for zippee

If you do not require the cookie to set on a computer/browser for certain length of time (few hours to few months), you can simply use session. Session is a safer option as some browsers block cookies. By the end of a session, use unset to remove the session value. Sessio will end automatically when the browser closed.

Member Avatar for Lafinboy

The values in [ ] in the function are optional, but if you want to skip one you need to put a placeholder value in, along the lines of:

setcookie("TestCookie", $value,'','/','domain.com');
Member Avatar for mark1048

The values in [ ] in the function are optional, but if you want to skip one you need to put a placeholder value in, along the lines of:

setcookie("TestCookie", $value,'','/','domain.com');

The above code will not work. Try this:

setcookie($cookieName, $cookieValue, NULL, $path, $domain);

You can read more tutorials on Cookies at:

--Mark

Member Avatar for Lafinboy

Exactly right, sorry, my bad. The expires value is the only non-string value, and so must be set to either null or 0 (zero), which will expire the cookie when the session ends.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.