sclass ServeHttp_CookieHandler {
  int days = 365;
  S cookieName = "cookie";
  bool verbose;
  S cookieValue;
  S metaParams; // e.g. "SameSite=Strict"
  bool shareCookiesBetweenApexDomains;

  // returns cookie (may be empty if client doesn't accept cookies)
  S handle() {
    NanoHTTPD.IHTTPSession session = NanoHTTPD.currentSession!;
    if (session == null) null;
    NanoHTTPD.CookieHandler cookies = session.getCookies();
    if (empty(cookieValue)) cookieValue = cookies.read(cookieName);
    S existingValue = cookieValue;
    var headers= session.getHeaders();
    if (empty(cookieValue) && empty((S) mapGet(headers, "x-no-cookies"))) {
      cookieValue = createNewCookie();
      if (verbose)
        print("New cookie.");
    }
    
    if (verbose)
      print("IP " + session.remoteIp() + ", cookie: " + cookieValue);
      
    if (!eq_nullIfEmpty(existingValue, cookieValue)) {
      var cookie = cookies.set(cookieName, cookieValue + prependIfNempty("; ", metaParams), days);
      
      S apexDomain = apexDomain(dropPortFromHost(session.getHeaders().get("host")));
      if (shareCookiesBetweenApexDomains && nempty(apexDomain))
        cookie.domain = apexDomain;
    }

    ret cookieValue; 
  }
  
  swappable S createNewCookie() {
    ret randomID(20);
  }
}