unicorn/no-document-cookie

document.cookie = "..." looks like it replaces all cookies, but it only adds or changes one. You also build the string by hand, so you need to encode the value and spell path, max-age, and the other attributes correctly. The browser silently ignores anything it doesn't understand. The Cookie Store API and cookie libraries take an object instead.

Only assignments are reported. Reading document.cookie is allowed.

Configure

Off by default. To turn it on:

[lint.rules]
"unicorn/no-document-cookie" = "error" # or "warn"

Examples

Reported:

document.cookie = "theme=dark; path=/";

Not reported:

await cookieStore.set({ name: "theme", value: "dark", path: "/" });

const isDark = document.cookie.includes("theme=dark");

When not to use it

The Cookie Store API only works on pages served over HTTPS, and older browsers don't have it. If you can't use it or a cookie library, turn the rule off.