sclass ServeHttp_CookieHandler {

  int days = 365;

  S cookieName = "cookie";

  bool verbose;

  S cookieValue;

  S metaParams; // e.g. "SameSite=Strict"

  bool shareCookiesBetweenApexDomains;

  // returns cookie (may be empty if client doesn't accept cookies)

  S handle() {

    NanoHTTPD.IHTTPSession session = NanoHTTPD.currentSession!;

    if (session == null) null;

    NanoHTTPD.CookieHandler cookies = session.getCookies();

    if (empty(cookieValue)) cookieValue = cookies.read(cookieName);

    S existingValue = cookieValue;

    var headers= session.getHeaders();

    if (empty(cookieValue) && empty((S) mapGet(headers, "x-no-cookies"))) {

      cookieValue = createNewCookie();

      if (verbose)

        print("New cookie.");

    }

    if (verbose)

      print("IP " + session.remoteIp() + ", cookie: " + cookieValue);

    if (!eq_nullIfEmpty(existingValue, cookieValue)) {

      var cookie = cookies.set(cookieName, cookieValue + prependIfNempty("; ", metaParams), days);

      S apexDomain = apexDomain(dropPortFromHost(session.getHeaders().get("host")));

      if (shareCookiesBetweenApexDomains && nempty(apexDomain))

        cookie.domain = apexDomain;

    }

    ret cookieValue; 

  }

  swappable S createNewCookie() {

    ret randomID(20);

  }

}