Set Custom Cookies on a Response

Sometimes you want your own cookie, separate from the session, to remember a theme or a preference for a visitor. 🍪

Cookies are written onto a response object. So first build one with make_response instead of returning a plain string.

Add the cookie with set_cookie, passing a name and a value. Then return that response so the header reaches the browser.

On the next request the browser sends it back. Read your cookie from request.cookies, which works like a dictionary.

Set max_age in seconds to control how long a cookie survives. Leave it out and the cookie dies when the browser closes.

The secure flag tells the browser to send the cookie only over HTTPS, keeping it off plain unencrypted connections.

Turn on httponly so client-side scripts cannot read the cookie. This blocks a common cross-site scripting theft path.

The samesite option controls when the cookie travels on cross-site requests. Set it to Lax or Strict to curb CSRF risk.

To remove one, call delete_cookie with its name on the response. The browser then drops it on the next visit.

Cookie values are always strings. To store a number or flag, convert it on the way out and parse it on the way back in.

Browsers cap each cookie near four kilobytes. Keep them tiny and store large data on the server, referenced by an id.

You want a cookie that JavaScript on the page cannot read.

You learned to build a response, write cookies with set_cookie, read them from request.cookies, and harden them with secure flags. 🛡️