Recursive function for creating a cookies string

Question

I've created the following function that creates a cookie string for passing to cURL. It can take a nested array or object of key-value pairs. It can either create nested cookie values as JSON, or using square brackets in cookie names.

Please could someone kindly:

1. Assess whether it's functionally correct or not, does it generate good cookies? I don't know if it's necessary for it to repeat the expires/domain/path/secure/httponly for each cookie.
2. Help reduce the bloat. I don't like how: (a) it calls itself 3 times. (b) it has the following code twice: $keyPrefix?$keyPrefix."[".$key."]":$key (c) in the middle, it checks: if (is_object($val) || is_array($val)) - it seems a bit redundant.

The function:

function http_build_cookie($data, $useJson=true, $expires = 0, $path = '', $domain = '', $secure = false, $httpOnly = false, $keyPrefix = '') {
    if (is_object($data)) {
        $data = (array) $data;
    }
    if (is_array($data)) {
        $cookie_parts = array();
        foreach ($data as $key => $val) {
            if ($useJson)
            {
                $cookie_parts[] = http_build_cookie(
                    rawurlencode($key)."="
                    .rawurlencode(json_encode($val)),
                    $useJson, $expires, $path, $domain, $secure, $httpOnly
                );
            }
            else
            {
                if (is_object($val) || is_array($val)) {
                    $cookie_parts[] = http_build_cookie(
                        $val, $useJson, $expires, $path, $domain,
                        $secure, $httpOnly, $keyPrefix?$keyPrefix."[".$key."]":$key
                    );
                }
                else
                {
                    $cookie_parts[] = http_build_cookie(
                        rawurlencode($keyPrefix?$keyPrefix."[".$key."]":$key)."="
                        .rawurlencode($val),
                        $useJson, $expires, $path, $domain, $secure, $httpOnly
                    );
                }
            }
        }
        return implode('; ', $cookie_parts);
    }
    if (is_scalar($data)) {
        $cookie = $data;
        if ($expires) {
            $cookie .= '; expires=' . gmdate('D, d-M-Y H:i:s T', $expires);
        }
        if ($path) {
            $cookie .= '; path=' . $path;
        }
        if ($domain) {
            $cookie .= '; domain=' . $domain;
        }
        if ($secure) {
            $cookie .= '; secure';
        }
        if ($httpOnly) {
            $cookie .= '; HttpOnly';
        }
        return $cookie;
    }
    return '';
}

Any advice would be massively appreciated!

Answer 1

I had a go at refactoring your code for you to make it more simple, otherwise the functionality seemed to work from what I could see.

    $cookie_parts = array();

    // Check if data is a scalar value
    if (is_scalar($data)) {
        $cookie_parts[] = rawurlencode($keyPrefix) . '=' . rawurlencode($data);
    }
    // Check if data is an array or object
    elseif (is_array($data) || is_object($data)) {
        // Loop through array/object keys and values
        foreach ($data as $key => $val) {
            // Generate the key name based on whether a prefix is set or not
            $cookie_key = $keyPrefix ? $keyPrefix . '[' . $key . ']' : $key;
            
            // If value is an array/object, recursively call this function
            if (is_array($val) || is_object($val)) {
                $cookie_parts[] = http_build_cookie(
                    $val, $useJson, $expires, $path, $domain, $secure, $httpOnly, $cookie_key
                );
            }
            // If value is a scalar, generate the cookie string
            else {
                $cookie_value = $useJson ? json_encode($val) : $val;
                $cookie_parts[] = rawurlencode($cookie_key) . '=' . rawurlencode($cookie_value);
            }
        }
    }

    // Append the common cookie attributes to the final cookie string
    $cookie = implode('; ', $cookie_parts);
    if ($expires) {
        $cookie .= '; expires=' . gmdate('D, d-M-Y H:i:s T', $expires);
    }
    if ($path) {
        $cookie .= '; path=' . $path;
    }
    if ($domain) {
        $cookie .= '; domain=' . $domain;
    }
    if ($secure) {
        $cookie .= '; secure';
    }
    if ($httpOnly) {
        $cookie .= '; HttpOnly';
    }

    return $cookie;
}

Answer 2

Cookies are typically used only for simple values

Cookies typically are used to store simple data like a session id - not complex data. Refer to the introduction section on the MDN documentation Using HTTP Cookies - especially the last paragraph:

An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to a user's web browser. The browser may store the cookie and send it back to the same server with later requests. Typically, an HTTP cookie is used to tell if two requests come from the same browser—keeping a user logged in, for example. It remembers stateful information for the stateless HTTP protocol.

Cookies are mainly used for three purposes:

Session management

Logins, shopping carts, game scores, or anything else the server should remember

Personalization

User preferences, themes, and other settings

Tracking

Recording and analyzing user behavior

Cookies were once used for general client-side storage. While this made sense when they were the only way to store data on the client, modern storage APIs are now recommended. Cookies are sent with every request, so they can worsen performance (especially for mobile data connections). Modern APIs for client storage are the Web Storage API (localStorage and sessionStorage) and IndexedDB.

Format code per PSR-12 style guide

PSR-12 is intended to "to reduce cognitive friction when scanning code from different authors" .... "by enumerating a shared set of rules and expectations about how to format PHP code" ¹. This will greatly decrease the number of lines and spacing.

Below is the output from the analysis via WEBCodeSniffer.net:

----------------------------------------------------------------------
FOUND 52 ERRORS AND 1 WARNING AFFECTING 16 LINES
----------------------------------------------------------------------
  1 | ERROR   | [x] End of line character is invalid; expected "\n"
    |         |     but found "\r\n"
  2 | ERROR   | [x] Incorrect spacing between argument "$useJson" and
    |         |     equals sign; expected 1 but found 0
  2 | ERROR   | [x] Incorrect spacing between default value and
    |         |     equals sign for argument "$useJson"; expected 1
    |         |     but found 0
  2 | WARNING | [ ] Line exceeds 120 characters; contains 143
    |         |     characters
  2 | ERROR   | [x] Opening brace should be on a new line
  9 | ERROR   | [x] Expected 1 space(s) after closing parenthesis;
    |         |     found newline
 12 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 12 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 13 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 14 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 14 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 14 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 14 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 14 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 16 | ERROR   | [x] Expected 1 space after closing brace; newline
    |         |     found
 17 | ERROR   | [x] Expected 1 space(s) after ELSE keyword; newline
    |         |     found
 21 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 21 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 21 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 21 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 22 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 22 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 22 | ERROR   | [x] Expected at least 1 space before "?"; 0 found
 22 | ERROR   | [x] Expected at least 1 space after "?"; 0 found
 22 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 22 | ERROR   | [x] Expected at least 1 space before ":"; 0 found
 22 | ERROR   | [x] Expected at least 1 space after ":"; 0 found
 24 | ERROR   | [x] Expected 1 space after closing brace; newline
    |         |     found
 25 | ERROR   | [x] Expected 1 space(s) after ELSE keyword; newline
    |         |     found
 28 | ERROR   | [x] Expected at least 1 space before "?"; 0 found
 28 | ERROR   | [x] Expected at least 1 space after "?"; 0 found
 28 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space before ":"; 0 found
 28 | ERROR   | [x] Expected at least 1 space after ":"; 0 found
 28 | ERROR   | [x] Expected at least 1 space before "."; 0 found
 28 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 29 | ERROR   | [x] Expected at least 1 space after "."; 0 found
 30 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 30 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 30 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 30 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 30 | ERROR   | [x] Only one argument is allowed per line in a
    |         |     multi-line function call
 57 | ERROR   | [x] Expected 1 newline at end of file; 0 found

The opening braces for the blocks of the first two if statements exist on the same line ✅, though the next if statement has the brace starting on the following line:

 if ($useJson)
 {

And the three lines with the else in-between

        }
        else
        {

can be simplified to a single line

} else {

Use Variable parsing (String interpolation) in double quoted strings

There are places in the code like:

 $keyPrefix?$keyPrefix."[".$key."]":$key

The concatenation can be removed using Variable parsing:

$keyPrefix ? "{$keyPrefix}[$key]" : "$key"

The complex syntax using { and } around $keyPrefix are required so the square braces won't be interpreted as array access.

Answer 3

The curl way of managing cookies is using the curls options.

curl_setopt( $curl_handle, CURLOPT_COOKIESESSION, true );
curl_setopt( $curl_handle, CURLOPT_COOKIEJAR, $uniquefilename );
curl_setopt( $curl_handle, CURLOPT_COOKIEFILE, $uniquefilename );

The above code is taken from this SO thread: https://stackoverflow.com/questions/12885538/php-curl-and-cookies

I am a bit suspicious that you are worried about the problems with storing the cookies in a file as described in that thread.

However, you are probably confused about how cookies work.

Server may send Set-Cookie headers, each containing a key-value pair with all the cookie options.

Client stores the (server) cookies received from server in a "cookie jar".

Client may also add or remove any (client) cookies in the cookie jar.

In consecutive requests the client queries the cookie jar with the request url and the cookie jar returns the keys and values of cookies that match that url according to the cookies' options.

Client then sends those key-value pairs in Cookie header to the requested url.

To implement own cookie management over curl you will need

• function to build Cookie header from key-value pairs
• function to parse Set-Cookie header
• class to represent a parsed response cookie (key value pair with options)
• class to represent a cookie jar with methods to
  • add cookie (with options)
  • get cookies for given url

You have actually confused a lot of people here, including me.

Your function looks like it attempts to build a Set-Cokkie header. While the intent probably was to have it build a Cookie header. And in fact it builds a strange mix of both.

Anyway, don't be shy to use modern php features.

final readonly class Cookie
{
    public function __construct(
        public string $key,
        public string $value,
        public string $domain,
        public string $path = '',
        // ...
    )
    {
    }
}

interface CookieHeaderFactory
{
    /**
     * @param array<string, string> $cookies
     */
    public function createCookieHeaderValue(array $cookies): string;
}

interface SetCookieHeaderParser
{
    public function parseSetCookieHeaderValue(string $value): Cookie;
}

interface CookieJar
{
  public function addCookie(Cookie $cookie): void;

  /**
   * @return array<string, string>
   */
  public function getRequestCookies(string $url): array;
}

EDIT:

According to

Cookie: <cookie-list>

<cookie-list> A list of name-value pairs in the form of =. Pairs in the list are separated by a semicolon and a space ('; ').

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cookie

All you really need for the request Cookie header is this:

/**
 * @param array<string, string> $cookies
 */
function http_build_cookie_header_value(array $cookies): string
{
    $pairs = [];
    foreach ($cookies as $name => $value) {
        if (str_contains_forbidden_cookie_chars($name)) {
            throw new \InvalidArgumentException('Invalid cookie name: '. $name);
        }
        if (str_contains_forbidden_cookie_chars($value)) {
            throw new \InvalidArgumentException('Invalid cookie value: '. $value);
        }
        $pairs[] = $name . '=' . $value;
    }
    return \implode('; ', $pairs);
}

$cookies = ['PHPSESSID' => 'aaaaaaaaaa'];
$headerLine = 'Cookie: ' . http_build_cookie_header_value($cookies);

Encoding: Many implementations perform URL encoding on cookie values. However, this is not required by the RFC specification. The URL encoding does help to satisfy the requirements of the characters allowed for .

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

This is for Set-Cookie header but it clearly applies for Cookie as well.

So in fact, you don't need to encode the names and values. Instead you should make sure they dont contain any forbidden characters.

As for the part of updating cookies from Set-Cookie headers received from server. If you are only concerned about a single domain, you can omit the complexity of the cookie jar and all the cookie options. Basically just parse the <name>=<value> part of the response header and ignore everything else. Except maybe the Expires part which servers may use to delete a cookie by setting its expiration to the past. If a cookie value is empty string you may also consider the cookie to be deleted.

function http_update_cookies(array $previousCookies, array $responseHeaders): array
{
  // look up Set-Cookie headers
  // parse them for name=value
  // combine with $previousCookies
  // and return new set of cookies
}

Example of how you would combine it together

$cookies = ['PHPSESSID' => 'aaaaaaaaaa'];

$response1 = call_api($url1, ['Cookie' => http_build_cookie_header_value($cookies)]);

$cookies = http_update_cookies($cookies, $response['headers']);

$response2 = call_api($url2, ['Cookie' => http_build_cookie_header_value($cookies)]);

$cookies = http_update_cookies($cookies, $response['headers']);

// ...

```