> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/honojs/hono/llms.txt
> Use this file to discover all available pages before exploring further.

# Cookie

> Manage cookies with get, set, and delete operations

The Cookie helper provides utilities for reading, writing, and managing HTTP cookies in your Hono application, including support for signed cookies and cookie prefixes.

## Import

```typescript theme={null}
import { getCookie, setCookie, deleteCookie, getSignedCookie, setSignedCookie } from 'hono/cookie'
```

## Getting Cookies

### Get a Single Cookie

Retrieve a specific cookie value by name:

```typescript theme={null}
import { getCookie } from 'hono/cookie'

app.get('/cookie', (c) => {
  const value = getCookie(c, 'yummy_cookie')
  return c.text(`Cookie value: ${value}`)
})
```

### Get All Cookies

Retrieve all cookies as an object:

```typescript theme={null}
import { getCookie } from 'hono/cookie'

app.get('/cookies', (c) => {
  const cookies = getCookie(c)
  return c.json(cookies)
})
```

## Setting Cookies

### Basic Cookie

Set a simple cookie with default options:

```typescript theme={null}
import { setCookie } from 'hono/cookie'

app.get('/set', (c) => {
  setCookie(c, 'delicious_cookie', 'macha')
  return c.text('Cookie set!')
})
// Sets: delicious_cookie=macha; Path=/
```

### Cookie with Options

Set a cookie with custom options:

```typescript theme={null}
import { setCookie } from 'hono/cookie'

app.get('/set-advanced', (c) => {
  setCookie(c, 'great_cookie', 'banana', {
    path: '/',
    secure: true,
    domain: 'example.com',
    httpOnly: true,
    maxAge: 1000,
    expires: new Date(Date.UTC(2030, 11, 24, 10, 30, 59, 900)),
    sameSite: 'Strict',
  })
  return c.text('Cookie set with options!')
})
```

## Cookie Options

<ParamField path="path" type="string" default="/">
  The path where the cookie is available
</ParamField>

<ParamField path="secure" type="boolean">
  Whether the cookie should only be sent over HTTPS
</ParamField>

<ParamField path="domain" type="string">
  The domain where the cookie is available
</ParamField>

<ParamField path="httpOnly" type="boolean">
  Whether the cookie is accessible only through HTTP(S)
</ParamField>

<ParamField path="maxAge" type="number">
  Maximum age in seconds
</ParamField>

<ParamField path="expires" type="Date">
  Expiration date of the cookie
</ParamField>

<ParamField path="sameSite" type="'Strict' | 'Lax' | 'None'">
  SameSite attribute for CSRF protection
</ParamField>

<ParamField path="prefix" type="'secure' | 'host'">
  Cookie prefix for enhanced security
</ParamField>

## Signed Cookies

Signed cookies provide tamper protection by including a cryptographic signature.

### Set Signed Cookie

```typescript theme={null}
import { setSignedCookie } from 'hono/cookie'

app.get('/set-signed', async (c) => {
  const secret = 'secret chocolate chips'
  await setSignedCookie(c, 'delicious_cookie', 'macha', secret)
  return c.text('Signed cookie set!')
})
```

### Get Signed Cookie

```typescript theme={null}
import { getSignedCookie } from 'hono/cookie'

app.get('/get-signed', async (c) => {
  const secret = 'secret chocolate chips'
  const value = await getSignedCookie(c, secret, 'delicious_cookie')
  
  if (value === false) {
    return c.text('Invalid signature!')
  }
  
  return c.text(`Signed value: ${value}`)
})
```

<Note>
  `getSignedCookie` returns `false` if the signature is invalid, `undefined` if the cookie doesn't exist, or the cookie value if valid.
</Note>

### Get All Signed Cookies

```typescript theme={null}
import { getSignedCookie } from 'hono/cookie'

app.get('/get-all-signed', async (c) => {
  const secret = 'secret chocolate chips'
  const cookies = await getSignedCookie(c, secret)
  return c.json(cookies)
})
```

## Cookie Prefixes

Cookie prefixes provide additional security guarantees enforced by browsers.

### Secure Prefix

Cookies with `__Secure-` prefix must be set with the `secure` flag:

```typescript theme={null}
import { setCookie, getCookie } from 'hono/cookie'

app.get('/set-secure', (c) => {
  setCookie(c, 'token', 'secret123', {
    prefix: 'secure'
  })
  return c.text('Secure cookie set!')
})
// Sets: __Secure-token=secret123; Path=/; Secure

app.get('/get-secure', (c) => {
  const token = getCookie(c, 'token', 'secure')
  return c.text(`Token: ${token}`)
})
```

### Host Prefix

Cookies with `__Host-` prefix must be secure, have path `/`, and no domain:

```typescript theme={null}
import { setCookie, getCookie } from 'hono/cookie'

app.get('/set-host', (c) => {
  setCookie(c, 'session', 'abc123', {
    prefix: 'host'
  })
  return c.text('Host cookie set!')
})
// Sets: __Host-session=abc123; Path=/; Secure

app.get('/get-host', (c) => {
  const session = getCookie(c, 'session', 'host')
  return c.text(`Session: ${session}`)
})
```

<Warning>
  With `host` prefix, the `domain` and custom `path` options are automatically ignored for security.
</Warning>

## Deleting Cookies

### Basic Delete

```typescript theme={null}
import { deleteCookie } from 'hono/cookie'

app.get('/delete', (c) => {
  deleteCookie(c, 'delicious_cookie')
  return c.text('Cookie deleted!')
})
```

### Delete with Options

Match the same options used when setting the cookie:

```typescript theme={null}
import { deleteCookie } from 'hono/cookie'

app.get('/delete-advanced', (c) => {
  deleteCookie(c, 'delicious_cookie', {
    path: '/',
    secure: true,
    domain: 'example.com',
  })
  return c.text('Cookie deleted with options!')
})
```

### Get Deleted Value

`deleteCookie` returns the value that was deleted:

```typescript theme={null}
import { deleteCookie } from 'hono/cookie'

app.get('/delete-and-return', (c) => {
  const deletedValue = deleteCookie(c, 'delicious_cookie')
  return c.text(`Deleted: ${deletedValue}`)
})
```

## Generate Cookie Strings

For advanced use cases, generate cookie strings without setting them:

### Generate Regular Cookie

```typescript theme={null}
import { generateCookie } from 'hono/cookie'

const cookieString = generateCookie('name', 'value', {
  path: '/',
  secure: true,
  httpOnly: true
})
// Returns: name=value; Domain=example.com; Path=/; HttpOnly; Secure
```

### Generate Signed Cookie

```typescript theme={null}
import { generateSignedCookie } from 'hono/cookie'

const cookieString = await generateSignedCookie(
  'name',
  'value',
  'secret',
  { path: '/', secure: true }
)
```

## Multiple Cookies

Set multiple cookies in a single response:

```typescript theme={null}
import { setCookie } from 'hono/cookie'

app.get('/multiple', (c) => {
  setCookie(c, 'cookie1', 'value1')
  setCookie(c, 'cookie2', 'value2')
  setCookie(c, 'cookie3', 'value3')
  return c.text('Multiple cookies set!')
})
```

## Best Practices

<CardGroup cols={2}>
  <Card title="Use Signed Cookies" icon="shield">
    Use signed cookies for sensitive data that needs tamper protection
  </Card>

  <Card title="Set HttpOnly" icon="lock">
    Use `httpOnly: true` for cookies that don't need JavaScript access
  </Card>

  <Card title="Use Secure Flag" icon="shield-halved">
    Always use `secure: true` in production to ensure HTTPS-only transmission
  </Card>

  <Card title="Match Delete Options" icon="trash">
    When deleting cookies, use the same `path` and `domain` used when setting
  </Card>
</CardGroup>

## Security Considerations

<Warning>
  **Never store sensitive data in unsigned cookies** - Cookies can be easily read and modified by clients. Use signed cookies or server-side sessions for sensitive data.
</Warning>

<Info>
  Cookie prefixes (`__Secure-` and `__Host-`) provide additional security enforced by browsers. Use them for sensitive cookies.
</Info>