How should I set an arbitrary session value in a plugin?
Try this:

$cookie = new HttpCookie('myCookieName', $data, [ 'expire' =&gt; time() + 3600 ]);
craft()-&gt;request-&gt;getCookies()-&gt;add( $cookie-&gt;name, $cookie );


Your code for reading the cookie is fine.

Also – since you use the term "session value" and tagged your question w/ "security" – I'd like to point out that cookies and session variables are different things. The former is stored on the client (the browser), the latter only on the server.

Unless you specifically need a cookie (e.g. because you want the data to persist a certain amount of time) it might be better to just create a basic session variable, using the HttpSession service:

craft()-&gt;httpSession-&gt;add( $key, $value ); // Set the session variable
craft()-&gt;httpSession-&gt;get( $key ); // Get the session variable


Read more about session variables vs. cookies here