no-document-cookie.md

Do not use document.cookie directly

It's not recommended to use document.cookie directly as it's easy to get the string wrong. Instead, you should use the Cookie Store API or a cookie library.

Fail

document.cookie =
	'foo=bar' +
	'; Path=/' +
	'; Domain=example.com' +
	'; expires=Fri, 31 Dec 9999 23:59:59 GMT' +
	'; Secure';

document.cookie += '; foo=bar';

Pass

await cookieStore.set({
	name: 'foo',
	value: 'bar',
	expires: Date.now() + 24 * 60 * 60 * 1000,
	domain: 'example.com'
});

const array = document.cookie.split('; ');

import Cookies from 'js-cookie';

Cookies.set('foo', 'bar');