We Keep Coding

Managing session cookies in Java

I'm working in a java web application that should not allow a user to open it in 2 different tabs, and I'm using session cookies for that. It seems to work fine in most scenarios, but the problem is that the cookies are not cleared when the browsers exits. This is how I set the cookies:
String sCookie = "mycookie=true;Path=/;Domain=.mydomain.com;HttpOnly";
if (!response.containsHeader("Set-Cookie")) {
response.setHeader("Set-Cookie", sCookie);
} else {
response.addHeader("Set-Cookie", sCookie);
}
As I understand, if I don't specify the Expires field, the cookie should be deleted on browser close. This is how I validate if the cookie exists:
Cookie[] cookies = request.getCookies();
for (Cookie cookie : cookies) {
if ("mycookie".equals(cookie.getName()) && Boolean.valueOf(cookie.getValue())) {//some error}}
Is there any problem with this code? meaning, can I set the cookie with response.setHeader and then check it with request.getCookies()?
Sometimes I have problems deleting the cookie manually and then when I restart the browser the problem continues.
This is how I manually delete the cookie (on tab close):
String sCookie = "mycookie=;Path=/;Domain=.mydomain.com;HttpOnly";
if (!response.containsHeader("Set-Cookie")) {
response.setHeader("Set-Cookie", sCookie);
} else {
response.addHeader("Set-Cookie", sCookie);
}
Thanks in advance
UPDATE
This is how I create the cookie:
Cookie c = new Cookie("mycookie","true");
c.setDomain(".mydomain.com");
c.setPath("/");
c.setValue("true");
response.addCookie(c);
This is how I delete the cookie:
for (Cookie c : request.getCookies()) {
if ("mycookie".equals(c.getName())) {
c.setMaxAge(0);
c.setValue("");
}
}
But still not working. Actually, now the cookie is not deleted when I close the tab (this was working fine in my previous version with "Set-Cookie" :S).Another detail is that I'm not seeing my cookie in the Resources tab of Chrome's developer tools

As a general hint, you'd better use the response.addCookie(..) method and possibly use Cookie.setMaxAge(-1).
That said, that should be the default, so in order to understand the problem, you should use Firebug (or any browser developer tools) to inspect your cookies and check their max age. Before and after closing the browser. E.g. you may have some leftover cookie.

Actually you should set the cookies in different way:
Cookie myCookie = new Cookie(); // create your cookie
// set path, and other attributes you need
// add the cookie to the response
response.addCookie(myCookie);
Then to make a Cookie expire: :
myCookie.setMaxAge(0);
Also, in order to clean completely:
myCookie.setValue("");
myCookie.setPath("/");
So, you have to get all the cookies in the request, identify your's and clean it with something like this:
List<Cookie> cookies = request.getCookies();
for (Cookie cookie : cookies) {
// identify your cookie
if (identified) {
cookie.setMaxAge(0);
cookie.setValue("");
cookie.setPath("/");
}
}
If cookie.getName("Set-Cookie") does not match your Cookie, debug your code to see what name is assigned in the response.setHeader("Set-Cookie", sCookie);

Delete specific cookies from webengine JavaFX

I would like to delete some specific HTTP only cookies generated by the JavaFX webengine.
Chrome browser allows us to delete httponly cookie which means this is programmatically possible.
I am able to delete all cookies using
java.net.CookieManager manager = new java.net.CookieManager();
manager.getCookieStore().removeAll();
Using this the user is logged out from my application as well. I want to be able to delete all cookies except the one generated for my application.
Or is it possible to delete the same cookies using javascript.

Anyone looking for the solution. Here it is.
Set this right at the start of the main method of javafx.
cookieManager = new CookieManager();
cookieManager.setCookiePolicy(CookiePolicy.ACCEPT_ALL);
CookieHandler.setDefault(cookieManager);
Then on any event(I did it onclick of a button) call this
CookieStore cookieJar = Main.cookieManager.getCookieStore();
List<HttpCookie> cookies = cookieJar.getCookies();
for (HttpCookie ck: cookies) {
if(ck.getName().equals("JSESSIONID")){
System.out.println("JSESSIONID");
}else{
ck.setMaxAge(0);
System.out.println("CookieHandler retrieved cookie: " + ck);
}
}
I hope this helps someone cause I spent the entire day looking for the solution.

According to docs getCookies()
Returns an array containing all of the Cookie objects the client sent with this request. This method returns null if no cookies were sent.
So, you should be able to iterate through the list of cookies returned and identify the elegible(s) to be deleted:
Cookie[] cookies = request.getCookies();
for (int i = 0; i < cookies.length; i++) {
String name = cookies[i].getName();
String value = cookies[i].getValue();
}
If no you can override the cookie adding it with the addCookie(Cookie)

Cookie set on the response doesn't show up in subsequent request to server until browser has made two new subsequent requests

An initial request is made to the server, and in the response a cookie is added:
response.addCookie(studyPrefsCookie);
On the web page, in the developer tools, I can see the cookie that was just set. Great. Here's a pic:
My assumption is that now that the cookie is set, every subsequent request to my web application (same domain, same servletcontext, etc), will now contain this cookie value in the cookies available from the request object. However, it appears that on the very next request, the cookie value is not there, even though by inspecting the request in the developer tools shows the cookie value as being sent. On the second subsequent request, it shows up normally. Here's what the request looks like, same each time from the browser:
I even tested this again by starting from scratch, and then making an ajax call after the the first page load, back to the server. First ajax call had all the right cookies as far as the browser was concerned, but the httpservletrequest object's cookies didn't have it. Making another identical ajax call, now the server found the cookie value. Is this expected behavior?
I'm reading the cookie the same way on the server side, with some helper methods:
Cookie[] cookies = studyCookieService.getCookiesByName(request.getCookies(), "STUDYPREFS");
if(cookies.length > 0 && studyCookieService.doesCookieContainValue(cookies[0], studyCookieService.getConsentNotCompletedCookieValueWithoutStudyId())){
//redirect
return "redirect:/" + STUDY_CONTROLLER_REQUEST_PATH;
--service methods
public Cookie[] getCookiesByName(Cookie[] cookies, String cookieName){
List<Cookie> matchingCookies = new ArrayList<Cookie>();
if (cookies != null) {
for (Cookie ck : cookies) {
if (cookieName.equals(ck.getName())) {
matchingCookies.add(ck);
}
}
}
return matchingCookies.toArray(new Cookie[matchingCookies.size()]);
}

How to delete Cookies from different path?

I want to delete a Cookie through Java Code which I have written like,
Cookie[] cookies = request.getCookies(); //request - HttpServletRequest
for (int i = 0; i < cookies.length; i++) {
if (cookies[i].getName().equals("cam_passport")) {
cookies[i].setMaxAge(0);
cookies[i].setValue("");
response.addCookie(cookies[i]);
}
}
I am getting the list of cookies in the "cookies" object but not the required one "cam_passport".
What I have observed is, the PATH of this Cookie is different when I checked in Mozilla.
Where as, the list of Cookies which I am getting in my 'cookies' object have their path as "/".
And, for this "cam_passport" cookie, path is "/cognos10".
I need the above cookie to be deleted at one instance every time. How can I get the Cookies of different path like the above one?

You need to send a redirect to that path, perhaps along with a request parameter. You can then in a servlet or filter which is mapped on exactly that path obtain the cookie and delete it, if necessary based on presence of the request parameter. Finally you can redirect back to the original URL, if necessary based on a request parameter.
In the future, use cookie.setPath("/") during creating the cookie if you need the cookie to be available throughout the entire web application.

how to add data in cookie

I want to add two values in cookie and retrieve them. I am doing in this way, but I am getting only the first value, not the second.
Cookie c = new Cookie("a", a);
c.setMaxAge(60);
response.addCookie(c);
Cookie b = new Cookie("d", d);
b.setMaxAge(5 * 60);
response.addCookie(b);
While reading:
Cookie cookies[] = getRequest().getCookies();
Cookie myCookie = null;
if (cookies != null) {
for (int i = 0; i < cookies.length; i++) {
log.info("test ;;;"+cookies[i].getName());
}
}
This returns only one data.

You are likely reading them from the wrong request. The newly added cookies will only be available in the subsequent requests, they will not be reflected immediately in the current request. So if you for instance add a cookie to the response and then tries to read it from the current request (the one associated with the very same response where you added the cookie to), then you won't get the added cookie at all. This also applies when you're forwarding the request from one to other resource (i.e. Servlet or JSP).
Debug/read the request/response headers in the client side as well for the sake that. In FireFox you can use the Firebug for this (open the Firebug pane, go to tab Net, click the request in question and you'll see both the request/response headers, the cookies are in there as well).

I would implement something like:
for(int i= 0; i < cookies.length; i++) {
Cookie cookie = cookies[i];
log.info("name: " + cookie.getName())
log.info("value: " + cookie.getValue())
}
This should print name and values of the cookies. If this is not working, probably the cookies are not added correctly to the response. Check that the cookies length is the one expected.

You can do some thing like this dear, I have tested it and its working
response.addCookie(new Cookie("name","sunny"));
response.addCookie(new Cookie("pwd","sunnymehta"));
Cookie[] cookie=request.getCookies();
for(Cookie ck:cookie)
{
System.out.println(ck.getName());
}

I would take a look at the actual cookie being saved in your browser. The first thing that comes to mind is the fact that in the underlying file that stores your cookie data, there is actually only one file -- the cookie objects in your code are actually being encoded as name-value pairs in a single file. The article at http://www.quirksmode.org/js/cookies.html has some good detail on how the data is actually stored in the cookie file. (Actually more than name-value pairs, since it also accomodates the other cookie properties like the expiration date and the secure flag, but anyway the article will show you that format.)
I gather that your java calls should be writing a validly formatted cookie file, and generating a valid array of cookie objects for you. But the fact that you're getting one object back seems suspicious to me in light of the underlying data format of the cookie.
In the past I've used Cookie Pal to inspect raw cookie data, though the site mentions IE6 support so I guess it's a little out of date.