# `Cookie`

A cookie as a server sets it: `SID=31d4d96e; Path=/; Secure; HttpOnly`.

Use it to read or record cookies from an outside service. Your own app's sign-in cookies are handled for you, so you don't set them.

## Shape

One value, held as text in one set form, with no parts: `__Host-SID=31d4d96e407aad42; Max-Age=3600; Path=/; Secure; SameSite=None`.

## Example

```jadpo
Cookie("SID=31d4d96e; Path=/; Secure; HttpOnly")
```

`Cookie(raw)` checks the text, and text that isn't one breaks the `format` rule.

`text.parse(raw, as: Cookie)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`, such as `SID=31d4 d96e`, `SID=31d4d96e; secure` or `SID=31d4d96e; HttpOnly; Secure`.

## Good to know

- Attributes are in the standard's order and spelling, so `secure` is refused.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.
- A field that holds one counts as personal data (`online`), so you don't mark it yourself.

## In JSON

A string, in a request, a response or `json.write`:

```json
"lang=en-GB"
"SID=31d4d96e407aad42; Path=/; Secure; HttpOnly; SameSite=Lax"
"lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com"
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`Cookie` is in the group Web and network, and has been in Jadpo since 0.1.0.

### Text form

`text.from` writes one standard text form, the same form `text.parse` reads back: `lang=en-GB`, `SID=31d4d96e407aad42; Path=/; Secure; HttpOnly; SameSite=Lax` and `lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com`.

### How it is stored

It is stored in one column named for the field, of type `text`. `lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com` is stored as `'lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com'`.

### How it is shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `lang=en-GB` | `lang=en-GB` |
| `SID=31d4d96e407aad42; Path=/; Secure; HttpOnly; SameSite=Lax` | `SID=31d4d96e407aad42; Path=/; Secure; HttpOnly; SameSite=Lax` |
| `lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com` | `lang=en-US; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com` |
| `__Host-SID=31d4d96e407aad42; Max-Age=3600; Path=/; Secure; SameSite=None` | `__Host-SID=31d4d96e407aad42; Max-Age=3600; Path=/; Secure; SameSite=None` |

### Operations

It also takes `text.parse`, `text.from`, `text.format`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>