Cookie Management

Volten provides built-in cookie parsing and serialization without external dependencies.

Reading Cookies with ctx.cookies

Incoming cookies are automatically parsed into a key-value dictionary on ctx.cookies:

app.get("/profile", (ctx) => {
  const sessionId = ctx.cookies.session_id;
  const theme = ctx.cookies.theme || "light";

  return ctx.json({ sessionId, theme });
});

Setting Cookies with ctx.setCookie(name, value, options?)

Sets an outgoing cookie header:

app.post("/login", (ctx) => {
  ctx.setCookie("session_id", "xyz987654321", {
    httpOnly: true,
    secure: true,
    sameSite: "lax",
    maxAge: 86400, // 24 hours in seconds
    path: "/",
  });

  return ctx.json({ loggedIn: true });
});

CookieOptions Reference

CookieOptions7 properties

Configuration options passed to ctx.setCookie(name, value, options)

Property	Type	Default	Description
	boolean	false	Forbids JavaScript from accessing the cookie, mitigating XSS attacks.
	boolean	false	Ensures the cookie is only sent over HTTPS.
	"lax" | "strict" | "none"	undefined	Controls whether the cookie is sent with cross-site requests.
	number	undefined	Relative max age of the cookie in seconds from when the client receives it.
	Date	undefined	Absolute expiration date for the cookie.
	string	"/"	The URL path that must exist in the requested URL to send the cookie.
	string	undefined	The host domain to which the cookie will be sent.

Typeboolean

Defaultfalse

Forbids JavaScript from accessing the cookie, mitigating XSS attacks.

Typeboolean

Defaultfalse

Ensures the cookie is only sent over HTTPS.

Type"lax" | "strict" | "none"

Defaultundefined

Controls whether the cookie is sent with cross-site requests.

Typenumber

Defaultundefined

Relative max age of the cookie in seconds from when the client receives it.

TypeDate

Defaultundefined

Absolute expiration date for the cookie.

Typestring

Default"/"

The URL path that must exist in the requested URL to send the cookie.

Typestring

Defaultundefined

The host domain to which the cookie will be sent.

---