oxc-project/oxc · warning · OxcDiagnostic

Do not use `document.cookie` directly.

Error message

Do not use `document.cookie` directly.

What it means

Diagnostic from the oxlint rule `unicorn/no-document-cookie` (category: restriction). Hand-building the `document.cookie` assignment string is easy to get wrong (attribute names, quoting, expiry formatting), and the browser silently ignores malformed writes. The rule flags assignments to `document.cookie` — including compound forms (`+=`, `&&=`), `window.document.cookie`, and aliases resolved through variable declarations (`const doc = document; doc.cookie = ...`) — and points to the async Cookie Store API or a cookie library. Reads (`const c = document.cookie`) are not flagged.

Source

Thrown at crates/oxc_linter/src/rules/unicorn/no_document_cookie.rs:15

use oxc_ast::{
    AstKind,
    ast::{Expression, match_member_expression},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_span::{GetSpan, Span};

use crate::{
    AstNode, ast_util::get_declaration_of_variable, context::LintContext,
    globals::GLOBAL_OBJECT_NAMES, rule::Rule,
};

fn no_document_cookie_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Do not use `document.cookie` directly.")
        .with_help("Use the Cookie Store API or a cookie library instead.")
        .with_note("https://developer.mozilla.org/en-US/docs/Web/API/Cookie_Store_API")
        .with_label(span)
}

#[derive(Debug, Default, Clone)]
pub struct NoDocumentCookie;

declare_oxc_lint!(
    /// ### What it does
    ///
    /// Disallows direct use of
    /// [`document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie).
    ///
    /// ### Why is this bad?
    ///
    /// It's not recommended to use
    /// [`document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie)

View on GitHub (pinned to e1e7af627c)

Solutions

1. Write cookies with the Cookie Store API: `await cookieStore.set({ name, value, expires })`
2. Use a library (js-cookie, universal-cookie) when you must support browsers without cookieStore
3. Where the raw API is genuinely required, disable the rule for that file or suppress inline

Example fix

// before
document.cookie = 'theme=dark; Path=/; Secure';

// after
await cookieStore.set({ name: 'theme', value: 'dark', path: '/', secure: true });

// feature-detect before using the Cookie Store API
const hasCookieStore = typeof cookieStore !== 'undefined';
if (hasCookieStore) {
  await cookieStore.set({ name: 'theme', value: 'dark' });
} else {
  Cookies.set('theme', 'dark'); // library fallback
}

When it happens

Trigger: `document.cookie = 'foo=bar'`, `document.cookie += ';a=1'`, `window.document.cookie = ...`, `const doc = globalThis.document; doc.cookie = ...` — any assignment whose target resolves to document.cookie. Plain reads, `delete document.cookie`, and computed keys (`document[key] = ...`) pass.

Common situations: Cookie-consent and A/B-testing code; porting jQuery-era cookie snippets; enabling oxlint unicorn or restriction-category rules on a legacy front end and hitting failures in old cookie writers.

Related errors

• `alert`, `confirm` and `prompt` functions are not allowed
• Unexpected redeclaration of read-only global variable.
• Use `Array.isArray()` instead of `instanceof Array`.
• "body" is not allowed when method is "{method}"
• Invalid `removeEventListener` call.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/02d40f0c0d930525. Report an issue: GitHub.