Cookies

Ply wraps fasthttp cookie handling with three context helpers:

value := c.Cookie("session")
c.SetCookie(cookie)
c.DeleteCookie("session")

Set a cookie

SetCookie accepts a *fasthttp.Cookie. Acquire it from the pool and release it after the header is written:

cookie := fasthttp.AcquireCookie()
defer fasthttp.ReleaseCookie(cookie)

cookie.SetKey("session")
cookie.SetValue(token)
cookie.SetPath("/")
cookie.SetHTTPOnly(true)
cookie.SetSecure(true)
cookie.SetSameSite(fasthttp.CookieSameSiteLaxMode)
cookie.SetMaxAge(3600)

c.SetCookie(cookie)

The response copies the cookie when the header is built, so releasing it after SetCookie is safe.

Read a cookie

token := c.Cookie("session")
if token == "" {
	c.JSON(401, map[string]string{"error": "missing session"})
	return
}

Cookie returns the first matching value from the request Cookie header.

Delete a cookie

c.DeleteCookie("session")

Deletion sets an empty value, Path=/, and an expiry in the past.

Attributes

Use HttpOnly and Secure for session cookies. Use SameSite=Lax or SameSite=Strict unless a cross-site flow requires None. SameSite=None requires Secure.

Signing

Ply does not sign cookies. Do not store raw user data in a cookie and trust it on the next request. Store an opaque session ID and keep the session state on the server, or sign and verify the value yourself.

Size

Browsers reject oversized cookies, and cookies are sent with every matching request. Keep values small and store bulk data on the server.