appending Hash fragment after the path in setcookie function PHP

Question

I'm trying to set path in setcookie for my websites cookie, which contains a string followed by #wall , I could see path only till the first string, it's not accepting the # fraction of the path.

code goes like this:

 $wall = array(
     $this->database,
     $this->response['grouplist'][0],
     $this->username
 );

 setcookie(
     "wall",
     json_encode($wall),
     time() + 3600 * 24 * 1000 ,
     "/" + $this->database + "/#wall",
     ".mywebsite.com",
     0
 );

 session_set_cookie_params(0, '/', '.mywebsite.com');

output :

mywebsite.com   /S71c9524b57ab1b3383bcb14478b570b6      2019-07-16T06:37:55.065Z        92

score 1 · Answer 1 · edited Oct 07 '21 at 11:32

Fragment is not a part of Path

The # character specifies the fragment part of a URL (RFC 3986):

  URI         = scheme ":" hier-part [ "?" query ] [ "#" fragment ]

  hier-part   = "//" authority path-abempty
              / path-absolute
              / path-rootless
              / path-empty

So the fragment (wall, particularly) is a different part of URL, and is not considered as part of the path:

The path is terminated by the first question mark ("?") or number sign ("#") character, or by the end of the URI.

Moreover, fragments depend on the document MIME type and are evaluated by the user agent (RFC 3986, 3.5. Fragment), i.e. fragments are never sent to the server:

...the fragment identifier is not used in the scheme-specific
processing of a URI; instead, the fragment identifier is separated
from the rest of the URI prior to a dereference, and thus the
identifying information within the fragment itself is dereferenced
solely by the user agent...

In other words, URL fragments are not supposed to work in the cookie Path attributes, and the server is not supposed to know anything about fragments.

PHP syntax

Also note, + is an arithmetic operator, so your "/" + $this->database + "/#wall" is evaluated to 0. If you meant concatenation, use the . (dot) operator instead:

$s = 'abc';
echo "/" + $s + "/#wall", PHP_EOL;
echo "/" . $s . "/#wall", PHP_EOL;
echo "/{$s}/#wall", PHP_EOL;

Output

0
/abc/#wall
/abc/#wall

So you should replace your "arithmetic" expression with "/{$this->database}/#wall".

It may work... sometimes

I have tested how the current version of Mozilla Firefox processes cookies for a path with different fragments. As it turns, it actually writes the cookies into document.cookie for different fragments, but one has to hard-reload the page in order to update the cookies. So I doubt that this is a useful feature.

appending Hash fragment after the path in setcookie function PHP

1 Answers1

Fragment is not a part of Path

PHP syntax

It may work... sometimes