public final class HttpCookie extends Object implements Cloneable
There are 3 http cookie specifications:
Netscape draft
RFC 2109 - http://www.ietf.org/rfc/rfc2109.txt
RFC 2965 - http://www.ietf.org/rfc/rfc2965.txt
HttpCookie class can accept all these 3 forms of syntax.
Constructor and Description |
---|
HttpCookie(String name,
String value)
Constructs a cookie with a specified name and value.
|
Modifier and Type | Method and Description |
---|---|
Object |
clone()
Create and return a copy of this object.
|
static boolean |
domainMatches(String domain,
String host)
The utility method to check whether a host name is in a domain
or not.
|
boolean |
equals(Object obj)
Test the equality of two http cookies.
|
String |
getComment()
Returns the comment describing the purpose of this cookie, or
null if the cookie has no comment. |
String |
getCommentURL()
Returns the comment url describing the purpose of this cookie, or
null if the cookie has no comment url. |
boolean |
getDiscard()
Return the discard attribute of the cookie
|
String |
getDomain()
Returns the domain name set for this cookie.
|
long |
getMaxAge()
Returns the maximum age of the cookie, specified in seconds.
|
String |
getName()
Returns the name of the cookie.
|
String |
getPath()
Returns the path on the server
to which the browser returns this cookie.
|
String |
getPortlist()
Return the port list attribute of the cookie
|
boolean |
getSecure()
Returns
true if sending this cookie should be
restricted to a secure protocol, or false if the
it can be sent using any protocol. |
String |
getValue()
Returns the value of the cookie.
|
int |
getVersion()
Returns the version of the protocol this cookie complies
with.
|
boolean |
hasExpired()
Reports whether this http cookie has expired or not.
|
int |
hashCode()
Return hash code of this http cookie.
|
boolean |
isHttpOnly()
Returns
true if this cookie contains the HttpOnly
attribute. |
static List<HttpCookie> |
parse(String header)
Constructs cookies from set-cookie or set-cookie2 header string.
|
void |
setComment(String purpose)
Specifies a comment that describes a cookie's purpose.
|
void |
setCommentURL(String purpose)
Specifies a comment url that describes a cookie's purpose.
|
void |
setDiscard(boolean discard)
Specify whether user agent should discard the cookie unconditionally.
|
void |
setDomain(String pattern)
Specifies the domain within which this cookie should be presented.
|
void |
setHttpOnly(boolean httpOnly)
Indicates whether the cookie should be considered HTTP Only.
|
void |
setMaxAge(long expiry)
Sets the maximum age of the cookie in seconds.
|
void |
setPath(String uri)
Specifies a path for the cookie
to which the client should return the cookie.
|
void |
setPortlist(String ports)
Specify the portlist of the cookie, which restricts the port(s)
to which a cookie may be sent back in a Cookie header.
|
void |
setSecure(boolean flag)
Indicates whether the cookie should only be sent using a secure protocol,
such as HTTPS or SSL.
|
void |
setValue(String newValue)
Assigns a new value to a cookie after the cookie is created.
|
void |
setVersion(int v)
Sets the version of the cookie protocol this cookie complies
with.
|
String |
toString()
Constructs a cookie header string representation of this cookie,
which is in the format defined by corresponding cookie specification,
but without the leading "Cookie:" token.
|
public HttpCookie(String name, String value)
The name must conform to RFC 2965. That means it can contain only ASCII alphanumeric characters and cannot contain commas, semicolons, or white space or begin with a $ character. The cookie's name cannot be changed after creation.
The value can be anything the server chooses to send. Its
value is probably of interest only to the server. The cookie's
value can be changed after creation with the
setValue
method.
By default, cookies are created according to the RFC 2965
cookie specification. The version can be changed with the
setVersion
method.
name
- a String
specifying the name of the cookievalue
- a String
specifying the value of the cookieIllegalArgumentException
- if the cookie name contains illegal characters
or it is one of the tokens reserved for use
by the cookie protocolNullPointerException
- if name is nullsetValue(java.lang.String)
,
setVersion(int)
public static List<HttpCookie> parse(String header)
header
- a String specifying the set-cookie header.
The header should start with "set-cookie", or "set-cookie2"
token; or it should have no leading token at all.IllegalArgumentException
- if header string violates the cookie
specification's syntax, or the cookie
name contains llegal characters, or
the cookie name is one of the tokens
reserved for use by the cookie protocolNullPointerException
- if the header string is nullpublic boolean hasExpired()
public void setComment(String purpose)
purpose
- a String
specifying the comment
to display to the usergetComment()
public String getComment()
null
if the cookie has no comment.String
containing the comment,
or null
if nonesetComment(java.lang.String)
public void setCommentURL(String purpose)
purpose
- a String
specifying the comment url
to display to the usergetCommentURL()
public String getCommentURL()
null
if the cookie has no comment url.String
containing the comment url,
or null
if nonesetCommentURL(java.lang.String)
public void setDiscard(boolean discard)
discard
- true indicates to discard cookie unconditionallygetDiscard()
public boolean getDiscard()
setDiscard(boolean)
public void setPortlist(String ports)
ports
- a String specify the port list, which is
comma seperated series of digitsgetPortlist()
public String getPortlist()
setPortlist(java.lang.String)
public void setDomain(String pattern)
The form of the domain name is specified by RFC 2965. A domain
name begins with a dot (.foo.com
) and means that
the cookie is visible to servers in a specified Domain Name System
(DNS) zone (for example, www.foo.com
, but not
a.b.foo.com
). By default, cookies are only returned
to the server that sent them.
pattern
- a String
containing the domain name
within which this cookie is visible;
form is according to RFC 2965getDomain()
public String getDomain()
String
containing the domain namesetDomain(java.lang.String)
public void setMaxAge(long expiry)
A positive value indicates that the cookie will expire after that many seconds have passed. Note that the value is the maximum age when the cookie will expire, not the cookie's current age.
A negative value means that the cookie is not stored persistently and will be deleted when the Web browser exits. A zero value causes the cookie to be deleted.
expiry
- an integer specifying the maximum age of the
cookie in seconds; if zero, the cookie
should be discarded immediately;
otherwise, the cookie's max age is unspecified.getMaxAge()
public long getMaxAge()
-1
indicating the cookie will persist
until browser shutdown.setMaxAge(long)
public void setPath(String uri)
The cookie is visible to all the pages in the directory you specify, and all the pages in that directory's subdirectories. A cookie's path must include the servlet that set the cookie, for example, /catalog, which makes the cookie visible to all directories on the server under /catalog.
Consult RFC 2965 (available on the Internet) for more information on setting path names for cookies.
uri
- a String
specifying a pathgetPath()
public String getPath()
String
specifying a path that contains
a servlet name, for example, /catalogsetPath(java.lang.String)
public void setSecure(boolean flag)
The default value is false
.
flag
- If true
, the cookie can only be sent over
a secure protocol like https.
If false
, it can be sent over any protocol.getSecure()
public boolean getSecure()
true
if sending this cookie should be
restricted to a secure protocol, or false
if the
it can be sent using any protocol.false
if the cookie can be sent over
any standard protocol; otherwise, true
setSecure(boolean)
public String getName()
String
specifying the cookie's namepublic void setValue(String newValue)
With Version 0 cookies, values should not contain white space, brackets, parentheses, equals signs, commas, double quotes, slashes, question marks, at signs, colons, and semicolons. Empty values may not behave the same way on all browsers.
newValue
- a String
specifying the new valuegetValue()
public String getValue()
String
containing the cookie's
present valuesetValue(java.lang.String)
public int getVersion()
setVersion(int)
public void setVersion(int v)
v
- 0 if the cookie should comply with
the original Netscape specification;
1 if the cookie should comply with RFC 2965/2109IllegalArgumentException
- if v is neither 0 nor 1getVersion()
public boolean isHttpOnly()
true
if this cookie contains the HttpOnly
attribute. This means that the cookie should not be accessible to
scripting engines, like javascript.true
if this cookie should be considered http only.setHttpOnly(boolean)
public void setHttpOnly(boolean httpOnly)
true
it means the cookie should not be accessible to scripting
engines like javascript.httpOnly
- if true
make the cookie HTTP only, i.e.
only visible as part of an HTTP request.isHttpOnly()
public static boolean domainMatches(String domain, String host)
This concept is described in the cookie specification. To understand the concept, some terminologies need to be defined first:
effective host name = hostname if host name contains dot
or = hostname.local if not
Host A's name domain-matches host B's if:
- their host name strings string-compare equal; or
- A is a HDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a HDN string. (So, x.y.com domain-matches .Y.com but not Y.com.)
A host isn't in a domain (RFC 2965 sec. 3.3.2) if:
- The value for the Domain attribute contains no embedded dots, and the value is not .local.
- The effective host name that derives from the request-host does not domain-match the Domain attribute.
- The request-host is a HDN (not IP address) and has the form HD, where D is the value of the Domain attribute, and H is a string that contains one or more dots.
Examples:
- A Set-Cookie2 from request-host y.x.foo.com for Domain=.foo.com would be rejected, because H is y.x and contains a dot.
- A Set-Cookie2 from request-host x.foo.com for Domain=.foo.com would be accepted.
- A Set-Cookie2 with Domain=.com or Domain=.com., will always be rejected, because there is no embedded dot.
- A Set-Cookie2 with Domain=ajax.com will be accepted, and the value for Domain will be taken to be .ajax.com, because a dot gets prepended to the value.
- A Set-Cookie2 from request-host example for Domain=.local will be accepted, because the effective host name for the request- host is example.local, and example.local domain-matches .local.
domain
- the domain name to check host name withhost
- the host name in questionpublic String toString()
public boolean equals(Object obj)
The result is true only if two cookies come from same domain (case-insensitive), have same name (case-insensitive), and have same path (case-sensitive).
equals
in class Object
obj
- the reference object with which to compare.Object.hashCode()
,
HashMap
public int hashCode()
getName().toLowerCase().hashCode()
+ getDomain().toLowerCase().hashCode()
+ getPath().hashCode()
hashCode
in class Object
Object.equals(java.lang.Object)
,
System.identityHashCode(java.lang.Object)
Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2020, Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. Also see the documentation redistribution policy.
Scripting on this page tracks web page traffic, but does not change the content in any way.