diff --git a/docs/helpers/cookie.md b/docs/helpers/cookie.md index 14b00f5f..623c1164 100644 --- a/docs/helpers/cookie.md +++ b/docs/helpers/cookie.md @@ -46,12 +46,15 @@ app.get('/signed-cookie', (c) => { 'cookie_name0' ) deleteCookie(c, 'cookie_name0') - // `getSignedCookie` will return `false` for a specified cookie if the signature was tampered with or is invalid + // `getSignedCookie` will return `false` for a specified cookie if its signature fails verification const allSignedCookies = await getSignedCookie(c, secret) // ... }) ``` +> [!NOTE] +> `getSignedCookie` distinguishes two cases. A cookie that has a signature but fails verification returns `false`. A cookie that does not have a valid signature format is treated as not being a signed cookie at all and returns `undefined` — the same as when the cookie is not present. This rule applies both when retrieving a single cookie by name and when retrieving all signed cookies. Since both `false` and `undefined` are falsy, `if (!value)` handles both cases. + ### Cookie Generation `generateCookie` and `generateSignedCookie` functions allow you to create cookie strings directly without setting them in the response headers.