Cookies are part of HTTP request so it's a good idea to do both in controller which responsibility is exactly dealing with request and response.