Question

In web.py, you can get access to the request’s cookies with web.webapi.cookies(), and you can set the value of a cookie with web.webapi.setcookie(...). The documentation isn’t clear on how one deletes a cookie, however — do you just setcookie with a value of None?

Answer 1

You’re right, it’s certainly not obvious from setcookie()‘s docstring, or from the online docs, but it is there somewhere:

The third (and optional) argument to web.setcookie(), “expires”, allows you to set when you want your cookie to expire. Any negative number will expire the cookie immediately.

For example, here’s part of what we do in our sign-out code (delete the user’s session cookie):

    web.setcookie('session', '', expires=-1, domain=session_cookie_domain)

Note that you must delete the cookie with the same domain and secure flag as you set it with, otherwise it won’t delete. Also, with web.py, you normally use web.setcookie() as a shortcut to web.webapi.setcookie().