duckweb_set_cookie

scalar · LOAD duckweb

duckweb_set_cookie(VARCHAR, VARCHAR, VARCHAR) -> VARCHAR

A Set-Cookie header line for the extra block.

duckweb_head(200, 'text/html',
  duckweb_set_cookie('seen', '1', 'Path=/; SameSite=Lax'))

The value is percent-encoded, because ; and , would otherwise split the cookie — and unlike a newline, the header helper would not strip them. duckweb_cookie decodes it again on the way back in.

attrs is appended verbatim, so any attribute works without duckweb having an opinion about which ones exist: Path=/; Max-Age=3600; HttpOnly; SameSite=Lax. Pass '' for none.

A name outside the HTTP token set produces nothing at all — no line. It cannot be encoded the way a value can, since encoding it would change which cookie is being set, and passing it through would let a name built from user input smuggle attributes or a second cookie into the line.