The only real way to check if cookies are disabled is to try and save the cookie in the users browser, and then download it with a subsequent request.
I think that in your situation you should set a cookie when they come to the login page. When they submit the login page, you can check if the cookie exists in the request. If this happens, everything will be fine and you will be able to authenticate the details presented. If this is not the case, you can display your message "cookies required".
Since at least requests to your site are required to complete this check, this means that you cannot display the message as soon as they request the login page, since you cannot assume that the user did not come to your site directly through this page.
source
share