FlareCookies

class FlareCookies

Read/write cookie API exposed via ctx.cookies.

Reads lazily parse the inbound Cookie header on first access and cache the result. Writes accumulate serialized Set-Cookie strings in an internal buffer that the runtime adapter drains when building the outgoing response.

Consumes only the CookieCarrier slice of the context: the inbound request headers and the signer slot, never the context’s wider surface.

How you get one

Handed to you by the framework; see Cookies.

Methods

delete()

delete(name: string, options?: { domain?: string; path?: string }): void

name string

options? { domain?: string; path?: string }

get()

get(name: string): string | undefined

name string

returns string | undefined

getAll()

getAll(): Readonly<Record<string, string>>

returns Readonly<Record<string, string>>

getSigned()

getSigned(name: string): Promise<string | undefined>

Reads a cookie written by setSigned, returning its value when the signature is valid and undefined when the cookie is absent, tampered with, or signed under a secret that is no longer accepted.

Requires cookies.secret to be configured. Throws if no secret is configured.

name string

returns Promise<string | undefined>

set()

set(name: string, value: string, options?: CookieOptions): void

Serializes name=value plus the given options into a Set-Cookie header.

Throws if sameSite: "None" is used without secure: true. Browsers reject unsecured SameSite=None cookies and silently correcting would mask the bug. The CookieOptions type also enforces this at compile time.

name string

value string

options? CookieOptions

setSigned()

setSigned(name: string, value: string, options?: CookieOptions): Promise<void>

Sets a cookie whose value is signed with the host’s cookie secret, producing a tamper-evident payload that getSigned verifies on read.

Signing provides integrity, not confidentiality: the value is encoded (not encrypted) and is recoverable by anyone who reads the cookie. Do not store secrets in a signed cookie.

Requires cookies.secret to be configured; a route can declare signedCookies: true to have host.build() enforce that at build time. Throws if no secret is configured.

name string

value string

options? CookieOptions

returns Promise<void>

Learn: Cookies