Check if Cookies are Enabled

If your app depends on cookies — sessions, CSRF tokens, consent flags — it is worth detecting early whether the browser will actually accept them, instead of failing on the first request that depends on one.

The modern one-liner

Since forever (and supported in every browser in use today), navigator.cookieEnabled does the job:

if (navigator.cookieEnabled) {
  console.log('cookies are enabled');
} else {
  console.log('cookies are disabled');
}

When to double-check

navigator.cookieEnabled reports the browser’s preference, not a verified write. Under strict privacy policies, cookie-blocking extensions or “block third-party cookies” modes, the flag can say yes while your own cookie still fails to persist. The reliable test is to write a cookie and read it back:

function cookiesEnabled() {
  if (!navigator.cookieEnabled) return false;
  document.cookie = 'cookietest=1; SameSite=Lax';
  const ok = document.cookie.indexOf('cookietest=') !== -1;
  // clean up: expire the test cookie
  document.cookie = 'cookietest=; expires=Thu, 01 Jan 1970 00:00:00 GMT';
  return ok;
}

The server can do the same dance without JavaScript: send a setcookie() probe on one request and check $_COOKIE on the next. If your framework regenerates session IDs on every request, a missing session cookie between two consecutive requests is itself the answer.

Whatever check you use, fail gracefully: fall back to a session-ID-in-URL scheme is not recommended in 2026 (it leaks identifiers via referrers and logs). Better to show the user a clear “please enable cookies” message for the features that genuinely require them.