{"record":{"id":"02d40f0c0d930525","repo":"oxc-project/oxc","slug":"do-not-use-document-cookie-directly","errorCode":null,"errorMessage":"Do not use `document.cookie` directly.","messagePattern":"Do not use `document\\.cookie` directly\\.","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/unicorn/no_document_cookie.rs","lineNumber":15,"sourceCode":"use oxc_ast::{\n    AstKind,\n    ast::{Expression, match_member_expression},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::{GetSpan, Span};\n\nuse crate::{\n    AstNode, ast_util::get_declaration_of_variable, context::LintContext,\n    globals::GLOBAL_OBJECT_NAMES, rule::Rule,\n};\n\nfn no_document_cookie_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Do not use `document.cookie` directly.\")\n        .with_help(\"Use the Cookie Store API or a cookie library instead.\")\n        .with_note(\"https://developer.mozilla.org/en-US/docs/Web/API/Cookie_Store_API\")\n        .with_label(span)\n}\n\n#[derive(Debug, Default, Clone)]\npub struct NoDocumentCookie;\n\ndeclare_oxc_lint!(\n    /// ### What it does\n    ///\n    /// Disallows direct use of\n    /// [`document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie).\n    ///\n    /// ### Why is this bad?\n    ///\n    /// It's not recommended to use\n    /// [`document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie)","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/unicorn/no_document_cookie.rs#L1-L33","documentation":"Diagnostic from the oxlint rule `unicorn/no-document-cookie` (category: restriction). Hand-building the `document.cookie` assignment string is easy to get wrong (attribute names, quoting, expiry formatting), and the browser silently ignores malformed writes. The rule flags assignments to `document.cookie` — including compound forms (`+=`, `&&=`), `window.document.cookie`, and aliases resolved through variable declarations (`const doc = document; doc.cookie = ...`) — and points to the async Cookie Store API or a cookie library. Reads (`const c = document.cookie`) are not flagged.","triggerScenarios":"`document.cookie = 'foo=bar'`, `document.cookie += ';a=1'`, `window.document.cookie = ...`, `const doc = globalThis.document; doc.cookie = ...` — any assignment whose target resolves to document.cookie. Plain reads, `delete document.cookie`, and computed keys (`document[key] = ...`) pass.","commonSituations":"Cookie-consent and A/B-testing code; porting jQuery-era cookie snippets; enabling oxlint unicorn or restriction-category rules on a legacy front end and hitting failures in old cookie writers.","solutions":["Write cookies with the Cookie Store API: `await cookieStore.set({ name, value, expires })`","Use a library (js-cookie, universal-cookie) when you must support browsers without cookieStore","Where the raw API is genuinely required, disable the rule for that file or suppress inline"],"exampleFix":"// before\ndocument.cookie = 'theme=dark; Path=/; Secure';\n\n// after\nawait cookieStore.set({ name: 'theme', value: 'dark', path: '/', secure: true });","handlingStrategy":"validation","validationCode":"// feature-detect before using the Cookie Store API\nconst hasCookieStore = typeof cookieStore !== 'undefined';\nif (hasCookieStore) {\n  await cookieStore.set({ name: 'theme', value: 'dark' });\n} else {\n  Cookies.set('theme', 'dark'); // library fallback\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Centralize cookie access in one module so raw document.cookie writes are reviewable","Feature-detect cookieStore; it is missing in some browsers and non-secure contexts","Keep the rule on: malformed cookie attribute strings are silently ignored by browsers"],"tags":["browser","dom","cookies","web-api","oxlint"],"backgroundTag":"document-cookie-access","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}