noDocumentCookie

JavaScript (and super languages)

Summary

• Rule available since: v1.9.4
• Diagnostic Category: lint/suspicious/noDocumentCookie
• This rule is recommended, which means is enabled by default.
• This rule doesn’t have a fix.
• The default severity of this rule is warning.
• Sources:
  • Same as unicorn/no-document-cookie

How to configure

biome.json

{
  "linter": {
    "rules": {
      "suspicious": {
        "noDocumentCookie": "error"
      }
    }
  }
}

Description

Disallow direct assignments to document.cookie.

It’s not recommended to use document.cookie directly as it’s easy to get the string wrong. Instead, you should use the Cookie Store API.

Examples

Invalid

document.cookie = "foo=bar";

code-block.js:1:1 lint/suspicious/noDocumentCookie ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Direct assigning to document.cookie is not recommended.
  
  > 1 │ document.cookie = “foo=bar”;
      │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ Consider using the Cookie Store API.
  

document.cookie += "; foo=bar";

code-block.js:1:1 lint/suspicious/noDocumentCookie ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Direct assigning to document.cookie is not recommended.
  
  > 1 │ document.cookie += ”; foo=bar”;
      │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ Consider using the Cookie Store API.
  

Valid

const array = document.cookie.split("; ");

await cookieStore
  .set({
    name: "foo",
    value: "bar",
    expires: Date.now() + 24 * 60 * 60,
    domain: "example.com",
})

import Cookies from 'js-cookie';

Cookies.set('foo', 'bar');

Related links

• Disable a rule
• Configure the code fix
• Rule options
• Source Code
• Test Cases