setcookie() issues on running with HTTPS on WordPress

Question

I have set 2 custom cookies to be saved when user clicks a button that runs the script to save the cookies.

The issue is that I need these to be saved through HTTPS because I am using them on a store locator page, and need a secured connection to allow for location detection to happen properly.

When I do not add TRUE for secure connection and leave code as shown below, the cookies save just fine when running through HTTP.

setcookie('lat', $_POST['lat'], time()+62208000, '/', $_SERVER['HTTP_HOST']);
setcookie('lng', $_POST['lng'], time()+62208000, '/', $_SERVER['HTTP_HOST']);

However, when I try to add TRUE for secure connection as shown below, it does not work properly with HTTPS running:

setcookie('lat', $_POST['lat'], time()+62208000, '/', $_SERVER['HTTP_HOST'], TRUE);
setcookie('lng', $_POST['lng'], time()+62208000, '/', $_SERVER['HTTP_HOST'], TRUE);

I have tried including httponly as either TRUE or FALSE as well, but nothing seems to have worked.

If anyone could give any tip about getting this resolved, I would appreciate it!

Thank you!

Answer 1

Both examples should work fine if your WordPress site is running on https://.

However, I would recommend you set up the cookies by using available constants and functions provided by WordPress, it makes things more organized. See example below:

setcookie( 'lat', sanitize_text_field( $_POST['lat'] ), strtotime( '+14 days' ), '/', esc_COOKIE_DOMAIN, is_ssl(), true );

Notice that I'm using is_ssl to check whether the site is running on https or not. This should work fine.

Also, don't insert any data coming from your web server environment without filtering it, always secure yourself.