<blockquote>
  <p>Is there any way I can get around this without resorting to my own PHP in the template or a custom plugin?</p>
</blockquote>

<p>You can't have PHP is a Twig template, but I think you'd need a real simple plugin for this.</p>

<p>It would just have an <code>init()</code> method that did:</p>

<pre><code>craft()-&gt;request-&gt;enableCookieValidation = false;
</code></pre>

<p>Just be aware that's going to make it much easier for people to potentially tamper with cookie values.</p>

CC BY-SA 3.0
2015-02-20T06:45:31.787Z
Thanks, Brad. I opted instead for a simple plugin with a Twig extension that lets me get a cookie for a specific key, so everything else remains secure.
Russ Back
CC BY-SA 3.0
2017-12-02T21:41:29.153Z
@RussBack could you mention the name of the plugin you're using?
nateclonch
CC BY-SA 3.0
2015-02-19T21:51:08.883Z
2015-02-19T21:51:08.883Z
Brad Bell
<p>We have a Laravel app that sets a cookie:</p>

<pre><code>public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true)
{
    list($path, $domain) = $this-&gt;getPathAndDomain($path, $domain);

    $time = ($minutes == 0) ? 0 : time() + ($minutes * 60);

    return new Cookie($name, $value, $time, $path, $domain, $secure, $httpOnly);
}
</code></pre>

<p>The values passed are as follows:</p>

<pre><code>array (size=7)
    0 =&gt; string 'imph_auth' (length=9)
    1 =&gt; string 'Russ Back' (length=9)
    2 =&gt; int 2628000
    3 =&gt; null
    4 =&gt; null
    5 =&gt; boolean false
    6 =&gt; boolean true
</code></pre>

<p>I've tried to retrieve that cookie in a Craft template as follows:</p>

<pre><code>craft.request.getCookie('imph_auth')
</code></pre>

<p>However I get null when I know that it's been set (I can browse to a Laravel template on the same domain and get the cookie).</p>

<p>I note the JavaScript warning in the Craft docs but this is set in PHP, however I can see the <strong>getCookies()</strong> method of the <strong>CookieCollection</strong> class runs each cookie through <strong>craft()->security->validateData()</strong> and fails validation.</p>

<p>Is there any way I can get around this without resorting to my own PHP in the template or a custom plugin?</p>

<security><session><cookies><request>
Unable to retrieve a cookie set by another application on the same domain
# Unable to retrieve a cookie set by another application on the same domain

(Asked by: username_0 on 2015-02-19)

We have a Laravel app that sets a cookie:
public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true)
{
    list($path, $domain) = $this->getPathAndDomain($path, $domain);

    $time = ($minutes == 0) ? 0 : time() + ($minutes * 60);

    return new Cookie($name, $value, $time, $path, $domain, $secure, $httpOnly);
}

The values passed are as follows:
array (size=7)
    0 => string 'imph_auth' (length=9)
    1 => string 'Russ Back' (length=9)
    2 => int 2628000
    3 => null
    4 => null
    5 => boolean false
    6 => boolean true

I've tried to retrieve that cookie in a Craft template as follows:
craft.request.getCookie('imph_auth')

However I get null when I know that it's been set (I can browse to a Laravel template on the same domain and get the cookie).
I note the JavaScript warning in the Craft docs but this is set in PHP, however I can see the getCookies() method of the CookieCollection class runs each cookie through craft()->security->validateData() and fails validation.
Is there any way I can get around this without resorting to my own PHP in the template or a custom plugin?

**Tags:** security, session, cookies, request

---

## 1 answers

### Answer by username_1 on 2015-02-19. Score: 1 | Accepted answer

Is there any way I can get around this without resorting to my own PHP in the template or a custom plugin?

You can't have PHP is a Twig template, but I think you'd need a real simple plugin for this.
It would just have an init() method that did:
craft()->request->enableCookieValidation = false;

Just be aware that's going to make it much easier for people to potentially tamper with cookie values.

> **Comments:**
> **username_0**: Thanks, Brad. I opted instead for a simple plugin with a Twig extension that lets me get a cookie for a specific key, so everything else remains secure.  
> **username_2**: @RussBack could you mention the name of the plugin you're using?  

---

