<cfcookie>

Defines cookie variables, including expiration and security options.

This tag cannot have a body.

This tag is also supported within <cfscript>

<cfcookie name=string value=string expires=object secure=boolean path=string domain=string httponly=boolean preservecase=boolean encodevalue=boolean samesite=Strict|Lax|None >
Attribute Description
name
string, required

The name of the cookie variable.
value
string, optional

The value assigned to the cookie variable.
expires
object, optional

Schedules the expiration of a cookie variable.

Can be specified:

  • as a date (as in, 10/09/97)
  • number of days (as in, 10, 100)
  • "Now"
  • "Never"

Using Now effectively deletes the cookie from the client browser.
secure
boolean, optional

Yes or No. Specifies that the variable must transmit securely. If the browser does not support Secure Socket Layer (SSL) security, the cookie is not sent.
path
string, optional

URL, within a domain, to which the cookie applies; typically a directory. Only pages in this path can use the cookie. By default, all pages on the server that set the cookie can access the cookie.

path = "/services/login"
domain
string, optional

Domain in which cookie is valid and to which cookie content can be sent from the user's system. By default, the cookie is only available to the server that set it. Use this attribute to make the cookie available to other servers.

Must start with a period. If the value is a subdomain, the valid domain is all domain names that end with this string. This attribute sets the available subdomains on the site upon which the cookie can be used.
httponly
boolean, optional

If HttpOnly is set to true, this cookie is marked as HttpOnly, by adding the HttpOnly attribute to it.

HttpOnly cookies are not supposed to be exposed to client-side scripting code, and may therefore help mitigate certain kinds of cross-site scripting attacks.
preservecase
boolean, optional

if set to true Lucee keep the original case for the name, otherwise the name is converted to a upper case string
encodevalue
boolean, optional

if set to true, Lucee url encodes the given name and value if necessary.

Alias: encode
samesite
string, optional

It will help to prevent Cross-Site Request Forgeries. Enabling this attribute on the cookie will instruct the browser to afford this cookie certain protections.

Values:

- strict
- lax
- none

Introduced: 5.3.7.33

Examples

CFCOOKIE Syntax

<cfcookie name="cookie" value=Now() domain=".local.com" path="/lucee" expires="10" httponly="yes" encodevalue="yes" samesite="strict"/>

See also