©SoftMooreSlide 1 Cookies

©SoftMooreSlide 2 Cookies Basic idea –web application sends a simple name/value pair to the client –when the client connects back to the same web site it returns the name/value pair Typical Uses –identifying the user during an e-commerce session (Remember: HTTP is a stateless protocol.) –customizing a site to the user –permit user to avoid logging in at low security sites

Cookie A named piece of data maintained by a browser, normally for session management. Can be use to store persistent information across multiple HTTP connections Encapsulated in class javax.servlet.http.Cookie Has a name, a single value, and optional attributes such as a comment, path and domain qualifiers, a maximum age, and a version number ©SoftMooreSlide 3 Cookies are stored on the client. Related session information is stored on the server.

Using Cookies All cookie data are strings. By default, the cookie lives for the life of the browser session. To enable a cookie to live longer, call setMaxAge(interval) –positive value sets the number of seconds a cookie exists –negative value destroys the cookie when the browser exits –zero immediately deletes (eats) the cookie (useful for clearing a previously stored cookie) ©SoftMooreSlide 4

Saving Cookies Create a Cookie object Cookie c = new Cookie("userId", "1234"); Set the maximum age (optional) c.setMaxAge(60*60*24*3); // three days Set the content type of the HttpServletResponse response to text/html. response.setContentType("text/html"); Add the cookie to the response response.addCookie(c) ; Send the response output ©SoftMooreSlide 5

©SoftMooreSlide 6 Example: Saving Cookies String sessionID = makeUniqueString(); // maintain shopping cart for this user Map sessionInfo = new HashMap (); // map session id to the user's shopping cart Map > globalTable = findTableStoringSessions(); globalTable.put(sessionID, sessionInfo); Cookie sessionCookie = new Cookie("JSESSIONID", sessionID); response.setContentType("text/html"); response.addCookie(sessionCookie); PrintWriter out = response.getWriter();...

©SoftMooreSlide 7 Retrieving Cookies Problems –must ask for all cookies and find the specific one you are interested in –possible that multiple cookies could have the same name but different path attributes (not usually a problem if cookies are used properly) Process –call request.getCookies() to retrieve an array of Cookie objects –loop through the array to find the cookie you need (call getName() on each cookie)

©SoftMooreSlide 8 Example: Retrieving Cookies Cookie[] cookies = request.getCookies(); if (cookies != null) { for(Cookie c : cookies) { if (c.getName().equals("JSESSIONID")) {... // do something with the cookie // e.g., use the value to retrieve the // user's shopping cart }

Methods in Class Cookie getDomain()/setDomain() –specify domain to which cookie applies –current host must be part of domain specified getMaxAge()/setMaxAge() –gets/sets the cookie expiration time (in seconds) –default is current browsing session if not set getName() –gets the cookie name –no setName method; name is supplied to the constructor ©SoftMooreSlide 9

Methods in Class Cookie (continued) getPath()/setPath() –gets/sets the path to which cookie applies –if not set, cookie applies to URLs that are within or below directory containing current page getSecure()/setSecure() –gets/sets flag indicating whether cookie should apply only to SSL connections or to all connections getValue()/setValue() –gets/sets value associated with cookie –value supplied to the constructor for new cookies ©SoftMooreSlide 10

Modifying a Cookie Value Send the same cookie name with a different cookie value Reusing an incoming cookie –must call response.addCookie() –merely calling setValue() is not sufficient –also need to reapply any relevant cookie attributes by calling setMaxAge(), setPath(), etc. –cookie attributes are not specified for incoming cookies Instructing the browser to delete a cookie –call setMaxAge(0) ©SoftMooreSlide 11