Working with HTTP Cookies

HTTP cookies provide a way to store small pieces of data in the client's browser. The TCookie class represents individual cookies, while TCookies manages collections of cookies. Cookies can have various attributes like expiration time, domain, path, and security settings.

Cookies are automatically sent by browsers with subsequent requests to the same domain, making them useful for session management, user preferences, and tracking.

program CookieExample;

{$mode objfpc}{$H+}

uses
  httpdefs, SysUtils, DateUtils;

procedure DemonstrateCookies(Response: TResponse);
var
  SessionCookie, PrefCookie, SecureCookie: TCookie;
begin
  // Create a session cookie (expires when browser closes)
  SessionCookie := Response.Cookies.Add;
  SessionCookie.Name := 'session_id';
  SessionCookie.Value := 'abc123xyz789';
  SessionCookie.Path := '/';

  // Create a preference cookie (expires in 30 days)
  PrefCookie := Response.Cookies.Add;
  PrefCookie.Name := 'user_theme';
  PrefCookie.Value := 'dark_mode';
  PrefCookie.Path := '/';
  PrefCookie.Domain := 'example.com';
  PrefCookie.Expires := Now + 30; // 30 days from now

  // Create a secure cookie for sensitive data
  SecureCookie := Response.Cookies.Add;
  SecureCookie.Name := 'auth_token';
  SecureCookie.Value := 'secure_token_here';
  SecureCookie.Path := '/admin';
  SecureCookie.Secure := True;     // Only sent over HTTPS
  SecureCookie.HttpOnly := True;   // Not accessible via JavaScript
  SecureCookie.SameSite := ssStrict; // CSRF protection
  SecureCookie.Expires := Now + (1/24); // Expires in 1 hour

  Writeln('Cookies set in response:');
  Writeln('1. Session cookie: ', SessionCookie.AsString);
  Writeln('2. Preference cookie: ', PrefCookie.AsString);
  Writeln('3. Secure cookie: ', SecureCookie.AsString);
end;

procedure ReadCookiesFromRequest(Request: TRequest);
var
  SessionID, Theme: String;
begin
  // Read cookies from request (simulate browser sending cookies)
  SessionID := Request.CookieFields.Values['session_id'];
  Theme := Request.CookieFields.Values['user_theme'];

  if SessionID <> '' then
    Writeln('Found session ID: ', SessionID)
  else
    Writeln('No session cookie found');

  if Theme <> '' then
    Writeln('User theme preference: ', Theme)
  else
    Writeln('No theme preference found');
end;

var
  Request: TRequest;
  Response: TResponse;
  Cookie: TCookie;
begin
  Request := TRequest.Create;
  Response := TResponse.Create(Request);
  try
    // Demonstrate setting cookies
    DemonstrateCookies(Response);

    // Simulate reading cookies from a request
    Writeln;
    Writeln('=== Simulating cookie reading ===');
    Request.CookieFields.Values['session_id'] := 'abc123xyz789';
    Request.CookieFields.Values['user_theme'] := 'dark_mode';
    ReadCookiesFromRequest(Request);

    // Demonstrate cookie expiration
    Writeln;
    Writeln('=== Cookie management ===');
    Cookie := Response.Cookies.FindCookie('session_id');
    if Cookie <> nil then
    begin
      Writeln('Expiring session cookie...');
      Cookie.Expire; // Sets expiration to past date
      Writeln('Cookie after expiration: ', Cookie.AsString);
    end;
  finally
    Response.Free;
    Request.Free;
  end;
end.