Setting cookies when form password is correct - php

Question

I have a form and when the users enter "Test" it should create a cookie and load the templates using require function. As soon as the cookie is enabled it will display the template. If the cookie expires it will require again the password. In other words, i if the password is "Test" i want to include that template for 12 hour to the user's browser before asking again for the password.
Below is what i am trying. More about cookies here
Problem is that the cookie idea is not working.
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$code = $_POST["SecretCode"];
}
if( $code === "test") {
$cookie_name = "user";
$cookie_value = "Cookie";
setcookie($cookie_name, $cookie_value, time() + (1000 * 10), "/"); // 86400 = 1 day
if(isset($_COOKIE[$cookie_name])) {
require_once 'template.php';
//echo 'cookie set:'.$_COOKIE[$cookie_name];
}
}?>
<form method="post" action='<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>'>
<input name="SecretCode" type="text" required>
<button>Check password</button>
</form>

Answer 1

Your cookie value within the $_COOKIE superglobal will not be populated until the next page request.
When you use setcookie the server will attempt to send a cookie to the client. If the cookie has not expired upon subsequent client requests, the client will present that cookie. Php will then use this value to populate the $_COOKIE superglobal.
In other words: setcookie('foo', 'bar', etc) does not immediately populate $_COOKIE['foo'].
You currently nest your template call like this:
if($code === "test") {
if(isset($_COOKIE[$cookie_name])) {
require_once 'template.php';
}
}
This requires that your secret is 'test' (from a form post) and that $_COOKIE['user'] is set. Your template therefore will not get included unless you submit your form with the correct value after the cookie has already been set (at least two successful form submissions and validations).
If you redirect after setcookie you can then rely moreso upon $_COOKIE. Do note that cookies can be spoofed:
<?php
$cookie_name = "user";
$cookie_value = "Cookie";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$secret = isset($_POST['secret']) ? $_POST['secret'] : null;
$forget = isset($_POST['forget']) ? $_POST['forget'] : null;
if($secret === "test") {
$cookie_expiry = time() + (24*60*60); // +1 day
setcookie($cookie_name, $cookie_value, $cookie_expiry , "/");
// Redirect here.
exit;
}
if($forget) {
$cookie_expiry = time() - (24*60*60); // -1 day
setcookie($cookie_name, '', $cookie_expiry , "/");
// Redirect here.
exit;
}
}
if(isset($_COOKIE[$cookie_name])) {
echo 'Cookie set.';
}
?>
<form method="post" action='<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>'>
<label for="secret">Secret:</label>
<input name="secret" type="text" required>
<input type="submit" value="Check in">
</form>
<form method="post">
<input type="submit" name="forget" value="Forget me">
</form>

Answer 2

This will also work:
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
$cookieName = 'User';
if (isset($_POST['SecretCode']) && ($_POST['SecretCode'] == 'test')) {
echo 'Password correct.<br>';
setcookie($cookieName,'Cookie',time()+86400,'/'); // 86400 = 1 day
echo 'Cookie was set.<br>';
echo 'Require template here.<br>';
} elseif (isset($_COOKIE[$cookieName])) {
echo 'Require template here as well.<br>';
echo 'Cookie value: ['.$_COOKIE[$cookieName].']<br>';
}
?>
<form method="post">
<input name="SecretCode" type="text" required>
<button>Check password</button>
</form>