Ask a Jedi: Creating lowercased cookies in ColdFusion

This post is more than 2 years old.

Chris asks:

When creating a cookie with cfcookie, the cookie is created in uppercase characters. Is there a way to make it lowercase?

What he means is, if you do this:

<cfcookie name="x" value="Foo">

And you examine your cookies, you will see that ColdFusion created the cookie and named it X. This may not seem like a big deal, but it gets important if you want to read the cookie in JavaScript.

I tried to get fancy and set a cookie like so:

<cfset cookie["y"] = 2>

But that made no difference. I did a quick Google and discovered a tech note from - wait for it - 2004:

The cfcookie tag is unable to create or delete mixed case or lowercase cookies

The solution they provide though still works today. You can use the cfheader tag to make the cookie yourself:

<cfheader name="Set-Cookie" value="mycookie=z;expires=#DateFormat(CreateDate(2009,12,31), 'ddd, dd-mmm-yyyy')# #TimeFormat(CreateTime(00,00,00), 'HH:mm:ss')# GMT">

Things get weird though if you use both forms:

<cfheader name="Set-Cookie" value="mycookie=z;expires=#DateFormat(CreateDate(2009,12,31), 'ddd, dd-mmm-yyyy')# #TimeFormat(CreateTime(00,00,00), 'HH:mm:ss')# GMT"> <cfset cookie.mycookie = 'm'>

I should have two cookies, one named mycookie, value z and another named MYCOOKIE, value is m. But when you view the cookie scope from ColdFusion, you see 2 keys with the exact same name (MYCOOKIE), both with a value of m.

So watch out if you are using ColdFusion to manipulate cookies that may also be manipulated via JavaScript.

Raymond Camden's Picture

About Raymond Camden

Raymond is a senior developer evangelist for Adobe. He focuses on document services, JavaScript, and enterprise cat demos. If you like this article, please consider visiting my Amazon Wishlist or donating via PayPal to show your support. You can even buy me a coffee!

Lafayette, LA https://www.raymondcamden.com

Archived Comments

Comment 1 by Will B. posted on 4/16/2008 at 11:13 PM

I had an issue a while back...wish I had blogged about it. The cookies from CF were coming out all uppercase, but when I would access (or create new) cookies from Javascript, they would be lower (or mixed) case. My solution, at the time, was to UPPERCASE all cookie names from ColdFusion and in Javascript. Otherwise, thisCookie was not the same at THISCOOKIE.

- Will B.

Comment 2 by Lola LB posted on 4/17/2008 at 3:32 PM

What's the reason for making cookies lowercase?

Comment 3 by Raymond Camden posted on 4/17/2008 at 3:34 PM

I don't know - maybe he makes them first in JS, and wants to keep them lowercase.

Comment 4 by Daniel Sellers posted on 4/17/2008 at 5:58 PM

My understanding is that CF doesn't respect case in variable names or scopes so even though you have mycookie and MYCOOKIE in the scope when you do the cfset it probably would view them as having the same variable name. Probably would result in them both being set to m.

e.g. cookie.MYCOOKIE == cookie.mycookie == cookie.MyCookiE

CF probably assumes that all the above are the same variable and if it encounters all of them in the cookie scope it sets them all equal to m.

Just a guess...

Comment 5 by Will B. posted on 4/17/2008 at 6:06 PM

@Daniel
Yes, that's true. But if you need to access those cookies with Javascript, the case does matter.

Comment 6 by Mickey posted on 9/20/2010 at 4:05 AM

Once again... you saved me half a bottle of Tylenol trying to figure out why I could not delete from JavaScript the cookie I created with CF. I'm fine with using uppercase... now that I know that works!
Thanks.

Comment 7 by ecomm_dev posted on 11/10/2011 at 6:07 PM

Was trying to delete a cookie created in cf8 from javascript changed the cfcookie tag attribute name to uppercase as suggested by some, with no success. Coldfusion includes the path by default as path=/ if it is not specified making the cookie a domain cookie. So if you trying to delete or change the cookie from javascript without including the path it does'nt work as it assumes the cookie is a page cookie not a domain cookie. When I included the path in the javascript that matched the coldfusion path, it worked like a charm.

Comment 8 by ss_nbk posted on 12/16/2014 at 5:23 PM

Ray thanks for this. Even 5 years later this is still helping people! Had two cookies, one being saved as lowercase and one as upper and could only get one to clear. Now we can clear them all. For others, you can add domain and path to the cfheader as well.

Comment 9 (In reply to #8) by Raymond Camden posted on 12/16/2014 at 5:25 PM

Always happy to hear that these old posts are helpful. :)