Servlet Cookie Sınıfı

Giriş
Şu satırı dahil ederiz.

import javax.servlet.http.Cookie;

Açıklaması şöyle.

Keep in mind that a cookie is actually defined by the tuple of it's name, path, and domain. 

Cookie Http Session için kullanılabilir. Açıklaması şöyle

In fact HTTP sessions are usually implemented using cookies.

Cookie'ler siteler tarafından insanları takip etmek için sıkça kullanılan bir yöntem.

Cookie'nin Değiştirilmesi
Açıklaması şöyle

I think the other answers fail to address the primary attack which is being protected against here, which is not forging the cookie, but tampering with it, or inspecting it.

If you send a cookie to a browser saying "current_user=tom", the user can send you back an alternative cookie saying "current_user=dave". If you have nothing to validate the cookie against, your application will assume they are logged in as "dave".

This could be mitigated by signing the cookie using a secret key - the tampered cookie would not have the correct signature, so would be rejected.

However, there may still be a problem: if part of the state you want to store is secret. For instance, you might want to store the cost price and markup of the products in the user's basket; clearly a plaintext cookie that the user can read is not appropriate here.

This leaves you with two solutions:

  - Encrypt the contents of the cookie, so that it can be neither read nor amended without knowing the private key.
  - Store the actual data locally (e.g. in a disk or memory store) and send only an identifier in the cookie. This is generally known as "session data".

İmzalı Cookie
Açıklaması şöyle

Cookies are not secure and can easily be modified by clients. If you need to set cookies to, e.g., identify the currently logged in user, you need to sign your cookies to prevent forgery. ...
Signed cookies contain the encoded value of the cookie in addition to a timestamp and an HMAC signature. 

constructor
Şöyle yaparız.

String strCookieName = ...;
Cookie cookie = new Cookie(strCookieName, "");

setComment metodu
Şöyle yaparız.

cookie.setComment("...");

setDomain metodu
Şöyle yaparız.

cookie.setDomain("...");

setHttpOnly metodu

Açıklaması şöyle

Cookies can be created in the browser using JavaScript. This is a bad practice. Ideally, cookies should always come from the server and be marked as HTTP only (and HTTPS only). This blocks JavaScript code from accessing the cookie.

That means that even if a script is added somehow or a bad link is clicked, it won’t have access to the cookie value. This mitigates XSS attacks so even if your site vulnerable the attack can’t steal the cookie. We can enable HttpOnly cookies when we set the cookie in the server code.

setMaxAge metodu
Açıklaması şöyle

A negative value means that the cookie is not stored persistently and will be deleted when the Web browser exits. A zero value causes the cookie to be deleted.

Silmek için şöyle yaparız.

cookie.setMaxAge(0);

setPath metodu
Şöyle yaparız.

cookie.setPath("/");

Şöyle yaparız.

String strPath = ...;
cookie.setPath(strPath);

setSecure metodu

Örnek

Şöyle yaparız. Cookie ismi "user"

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class CookieHandler {

  public Cookie createCookie(String serverName, String path) {
    Cookie userCookie = new Cookie("user", value);
    userCookie.setPath(path);
    userCookie.setHttpOnly(true);
    userCookie.setSecure(!"localhost".equals(serverName));
    userCookie.setMaxAge(30 * 1440 * 60);
    return userCookie;
  }
}

Açıklaması şöyle

The setSecure method is the key here. Setting the value as “false” would help us to test the cookie in the localhost.

I set the secure as true/false based on the server name. This code can also be used in production. Since it sets secure as false only if the server name is localhost.

setValue metodu

Şöyle yaparız.

cookie.setValue("");