no-document-cookie.md

Do not use document.cookie directly

✅ This rule is part of the recommended config.

It's not recommended to use document.cookie directly as it's easy to get the string wrong. Instead, you should use the Cookie Store API or a cookie library.

Fail

document.cookie =
	'foo=bar' +
	'; Path=/' +
	'; Domain=example.com' +
	'; expires=Fri, 31 Dec 9999 23:59:59 GMT' +
	'; Secure';

document.cookie += '; foo=bar';

Pass

await cookieStore.set({
	name: 'foo',
	value: 'bar',
	expires: Date.now() + 24 * 60 * 60 * 1000,
	domain: 'example.com'
});

const array = document.cookie.split('; ');

import Cookies from 'js-cookie';

Cookies.set('foo', 'bar');