Skip to content

Cookie scope - #25

Open
tomjn wants to merge 9 commits into
masterfrom
cookie-scope
Open

tomjn wants to merge 9 commits into
masterfrom
cookie-scope

Conversation

@tomjn

@tomjn tomjn commented Aug 4, 2025

Copy link
Copy Markdown
Contributor

Adds a new cookie based scope for flags that loads earlier

@tomjn tomjn added enhancement New feature or request help wanted Extra attention is needed labels Aug 4, 2025
@tomjn

tomjn commented Aug 4, 2025

Copy link
Copy Markdown
Contributor Author

Needs further testing

svandragt and others added 5 commits October 16, 2026 12:02
Cookie\save() called setcookie() with only a name and value. When the
flag is toggled through admin-ajax.php, the cookie then gets the
/wp-admin/ path, so front-end requests never send it, and it expires
when the browser closes.

Use the options form of setcookie() with COOKIEPATH, COOKIE_DOMAIN,
a Secure attribute that follows is_ssl(), HttpOnly, SameSite=Lax and
a one-year expiry. Also update $_COOKIE so reads later in the same
request see the new value, and correct the docblock: setcookie()
returns bool, not int.

Co-Authored-By: Claude <noreply@anthropic.com>
The branch added `: void` return types to functions in files the cookie
scope does not touch, and put a full stop in the plugin.php docblock.
Restore those files to their state on master so the pull request only
adds the cookie scope: inc/cookie.php, the Cookie\bootstrap() call and
the require_once.

Co-Authored-By: Claude <noreply@anthropic.com>
The updated coding standards in the coding-standards pull request
reject `function foo() : void` (PSR12.Functions.ReturnTypeDeclaration
.SpaceBeforeColon). Use `function foo(): void`, which the current
standards also accept, so the file passes lint before and after that
change.

Co-Authored-By: Claude <noreply@anthropic.com>
The "Scope of Setting a Flag" section listed only `user` and `site`.
Add `cookie`, and say why to pick it: the value lives in the visitor's
browser, so it works for logged-out visitors and is readable before
`init`, unlike the user scope.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
@svandragt

Copy link
Copy Markdown
Contributor

@tomjn I've picked this up. Changes since your last commit:

  • The cookie is now set for the whole site and lasts a year. Before, setcookie() had no path or expiry. Set from admin-ajax.php, the cookie only covered /wp-admin/, so front-end pages never received it, and it expired when the browser closed. It now also sets secure on HTTPS, httponly and SameSite=Lax, and updates $_COOKIE so the rest of the request sees the new value.
  • I reverted the : void return types in files the cookie scope doesn't touch, so this PR only adds the scope.
  • inc/cookie.php uses function foo(): void spacing. It passes both the current standards and the ones in Fix the WPCS code execution advisory and require PHP 8.2 #31 (Fix the WPCS code execution advisory and require PHP 8.2).
  • The README and the Flag docblocks now list cookie as a scope.

A smoke test with stubbed WordPress functions passes: a stored active cookie turns a default-off flag on, and toggling it passes the expected setcookie() arguments. I haven't tested this in a browser on a real site.

Merge this after #31. The options-array form of setcookie() needs PHP 7.3, and #31 raises the minimum to PHP 8.2.

@svandragt svandragt self-assigned this Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request help wanted Extra attention is needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants