I don't know if this is normal, but I have considerations: I'm running Laravel Lumen and using cookies for a kind of action (keep track of the user already validated a code). I have the EncryptCookies middleware enabled, so the cookies I set should be encrypted and signed. This means (by Laravel docs), that it is considered invalid if tampered with.

However, if I validate the code on one browser/computer so I have the cookie created (let's say Code:valid, the value encrypted of course) and use one of the Cookie tool add-ons available for Chrome/Firefox to create the cookie on another computer or change ex. the expiry of the cookie... it works, Laravel accepts the handmade or changed cookie.

Is there something I am missing?

I am checking the cookie like this

if ( $request->cookie('code') == 'valid' ) {