# unicorn/no-document-cookie

> Disallow assigning to `document.cookie`

`document.cookie = "..."` looks like it replaces all cookies, but it only adds or changes one. You also build the string by hand, so you need to encode the value and spell `path`, `max-age`, and the other attributes correctly. The browser silently ignores anything it doesn't understand. The Cookie Store API and cookie libraries take an object instead.

Only assignments are reported. Reading `document.cookie` is allowed.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"unicorn/no-document-cookie" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad */}
```js
document.cookie = "theme=dark; path=/";
```

Not reported:

{/* good */}
```js
await cookieStore.set({ name: "theme", value: "dark", path: "/" });
```

{/* good */}
```js
const isDark = document.cookie.includes("theme=dark");
```

## When not to use it

The Cookie Store API only works on pages served over HTTPS, and older browsers don't have it. If you can't use it or a cookie library, turn the rule off.