Java Notes

Cookies in Servlets

Complete guide to handling cookies in Java Servlets - creating, reading, modifying, deleting cookies, cookie attributes, and security best practices.

What are Cookies?

Cookies are small pieces of data (key-value pairs) stored on the client's browser and sent back to the server with every subsequent request. They provide a way to maintain state in the stateless HTTP protocol.

Creating and Sending Cookies

java example

@WebServlet("/set-cookie")
public class SetCookieServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String username = request.getParameter("username");
        String theme = request.getParameter("theme");

        // Create cookies
        Cookie userCookie = new Cookie("username", username);
        Cookie themeCookie = new Cookie("theme", theme);
        Cookie visitCookie = new Cookie("lastVisit", String.valueOf(System.currentTimeMillis()));

        // Set cookie properties
        userCookie.setMaxAge(60 * 60 * 24 * 7);  // 7 days
        userCookie.setPath("/");                    // Available to entire app
        userCookie.setHttpOnly(true);              // Not accessible via JavaScript
        userCookie.setSecure(true);                // Only sent over HTTPS

        themeCookie.setMaxAge(60 * 60 * 24 * 30); // 30 days
        themeCookie.setPath("/");

        visitCookie.setMaxAge(60 * 60 * 24 * 365); // 1 year
        visitCookie.setPath("/");

        // Add cookies to response
        response.addCookie(userCookie);
        response.addCookie(themeCookie);
        response.addCookie(visitCookie);

        response.setContentType("text/html");
        response.getWriter().println("<h2>Cookies Set Successfully!</h2>");
        response.getWriter().println("<p>Username: " + username + "</p>");
        response.getWriter().println("<a href=\"/read-cookie\">Read Cookies</a>");
    }
}

Reading Cookies

Example

@WebServlet("/read-cookie") public class ReadCookieServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); Cookie[] cookies = request.getCookies(); out.println("<h2>All Cookies</h2>"); if (cookies == null || cookies.length == 0) { out.println("<p>No cookies found!</p>"); return; } out.println("<table border=\"1\">"); out.println("<tr><th>Name</th><th>Value</th><th>Max Age</th><th>Path</th></tr>"); for (Cookie cookie : cookies) { out.println("<tr>"); out.println("<td>" + cookie.getName() + "</td>"); out.println("<td>" + cookie.getValue() + "</td>"); out.println("<td>" + cookie.getMaxAge() + "</td>"); out.println("<td>" + cookie.getPath() + "</td>"); out.println("</tr>"); } out.println("</table>"); } // Utility method to find a specific cookie private String getCookieValue(HttpServletRequest request, String cookieName) { Cookie[] cookies = request.getCookies(); if (cookies != null) { for (Cookie cookie : cookies) { if (cookie.getName().equals(cookieName)) { return cookie.getValue(); } } } return null; } }

Modifying Cookies

java example

@WebServlet("/update-cookie")
public class UpdateCookieServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // To modify a cookie, create a new one with same name
        String newTheme = request.getParameter("theme");

        Cookie themeCookie = new Cookie("theme", newTheme);
        themeCookie.setMaxAge(60 * 60 * 24 * 30); // Must reset max age
        themeCookie.setPath("/");                    // Must set same path

        response.addCookie(themeCookie); // Overwrites existing cookie

        response.setContentType("text/html");
        response.getWriter().println("<h2>Theme updated to: " + newTheme + "</h2>");
    }
}

Deleting Cookies

java example

@WebServlet("/delete-cookie")
public class DeleteCookieServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // To delete a cookie: set maxAge to 0
        Cookie userCookie = new Cookie("username", "");
        userCookie.setMaxAge(0);    // Immediately expires
        userCookie.setPath("/");     // MUST match the original path!
        response.addCookie(userCookie);

        // Delete theme cookie
        Cookie themeCookie = new Cookie("theme", "");
        themeCookie.setMaxAge(0);
        themeCookie.setPath("/");
        response.addCookie(themeCookie);

        response.setContentType("text/html");
        response.getWriter().println("<h2>Cookies Deleted!</h2>");
        response.getWriter().println("<a href=\"/read-cookie\">Verify</a>");
    }
}

⚠️ Critical: When deleting a cookie, the name and path must match exactly. If the original cookie was set with path=/app, you must delete it with path=/app.

Attribute	Method	Description
Name	Constructor	Cookie identifier (required)
Value	`setValue()`	Cookie data
Max-Age	`setMaxAge()`	Lifetime in seconds (-1 = session)
Path	`setPath()`	URL path scope
Domain	`setDomain()`	Domain scope
Secure	`setSecure(true)`	HTTPS only
HttpOnly	`setHttpOnly(true)`	No JavaScript access

Max-Age Values

Value	Meaning
Positive (e.g., 3600)	Cookie lives for that many seconds
0	Delete cookie immediately
-1 (default)	Session cookie (deleted when browser closes)

java example

@WebServlet("/login")
public class LoginServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // Check if remember-me cookie exists
        String savedUser = getCookieValue(request, "remember_user");
        String savedToken = getCookieValue(request, "remember_token");

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        if (savedUser != null && validateToken(savedUser, savedToken)) {
            // Auto-login
            HttpSession session = request.getSession();
            session.setAttribute("loggedInUser", savedUser);
            response.sendRedirect("/dashboard");
        } else {
            // Show login form
            out.println("<form method=\"POST\" action=\"/login\">");
            out.println("<input name=\"username\" placeholder=\"Username\"><br>");
            out.println("<input type=\"password\" name=\"password\" placeholder=\"Password\"><br>");
            out.println("<label><input type=\"checkbox\" name=\"remember\"> Remember me</label><br>");
            out.println("<button type=\"submit\">Login</button>");
            out.println("</form>");
        }
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String username = request.getParameter("username");
        String password = request.getParameter("password");
        String remember = request.getParameter("remember");

        if (authenticate(username, password)) {
            // Create session
            HttpSession session = request.getSession();
            session.setAttribute("loggedInUser", username);

            // Set remember-me cookies if checked
            if ("on".equals(remember)) {
                String token = generateSecureToken();

                Cookie userCookie = new Cookie("remember_user", username);
                userCookie.setMaxAge(60 * 60 * 24 * 30); // 30 days
                userCookie.setHttpOnly(true);
                userCookie.setSecure(true);
                userCookie.setPath("/");

                Cookie tokenCookie = new Cookie("remember_token", token);
                tokenCookie.setMaxAge(60 * 60 * 24 * 30);
                tokenCookie.setHttpOnly(true);
                tokenCookie.setSecure(true);
                tokenCookie.setPath("/");

                response.addCookie(userCookie);
                response.addCookie(tokenCookie);

                // Store token in database for validation
                saveTokenToDatabase(username, token);
            }

            response.sendRedirect("/dashboard");
        } else {
            response.sendRedirect("/login?error=invalid");
        }
    }

    private String getCookieValue(HttpServletRequest request, String name) {
        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
            for (Cookie c : cookies) {
                if (c.getName().equals(name)) return c.getValue();
            }
        }
        return null;
    }

    private boolean authenticate(String user, String pass) {
        // Check against database
        return "admin".equals(user) && "password123".equals(pass);
    }

    private boolean validateToken(String user, String token) {
        // Validate token from database
        return token != null && !token.isEmpty();
    }

    private String generateSecureToken() {
        return java.util.UUID.randomUUID().toString();
    }

    private void saveTokenToDatabase(String user, String token) {
        // Save to DB in real application
    }
}

Practice	Why
Set `HttpOnly=true`	Prevents XSS attacks from reading cookies
Set `Secure=true`	Cookie only sent over HTTPS
Set `SameSite=Strict`	Prevents CSRF attacks
Short expiration	Limits exposure window
Don't store sensitive data	Cookies are visible to user
Encrypt values	Protect against tampering
Validate on server	Never trust client data

Cookies vs Sessions

Feature	Cookies	Sessions
Storage	Client browser	Server memory
Size limit	4KB per cookie	No practical limit
Security	Less secure (visible)	More secure (server-side)
Lifetime	Configurable	Until timeout/invalidation
Performance	No server memory used	Uses server memory
Data type	Strings only	Any Java object

Common Mistakes

Not matching path when deleting — Cookie won't be deleted
Storing passwords in cookies — Never store sensitive data in cookies
Not encoding cookie values — Special characters break cookies
Exceeding 4KB limit — Browser silently drops oversized cookies
Forgetting HttpOnly for auth cookies — XSS vulnerability

Interview Key Points

Cookies are small data pieces stored on the client browser
Maximum size: 4KB per cookie, typically 20 cookies per domain
setMaxAge(0) deletes; setMaxAge(-1) makes session cookie
HttpOnly prevents JavaScript access (XSS protection)
Secure flag ensures HTTPS-only transmission
Cookies are sent with EVERY request to the matching domain/path

Summary

In this chapter, we learned about Cookies in Servlets in detail. Here are the key points:

Basic introduction to the concept and why it is needed
Syntax and structure with complete examples
Internal working and best practices
Real-world applications and use cases
Common mistakes and how to avoid them
How this topic is asked in interviews

To practice these concepts, write and run the code in your IDE and verify the output. Modify each example and experiment so that you deeply understand the concept.

Exam Focus

Revise definitions, diagrams, examples, and short-answer points for Cookies in Servlets.

Interview Use

Prepare one clear explanation, one practical example, and one common mistake for this Java Master Course topic.

Search Terms

java-master-course, java master course, java, master, course, servlets, jsp, cookies

Continue learning this concept

Servlets JSPExpression Language (EL)Complete guide to JSP Expression Language (EL) - syntax, operators, implicit objects, accessing beans, collections, and EL functions for clean JSP development.Servlets JSPGenericServletUnderstanding GenericServlet abstract class in Java - protocol-independent servlet implementation, methods, and comparison with HttpServlet.Servlets JSPHttpServletComplete guide to HttpServlet class - HTTP-specific servlet implementation with doGet, doPost, doPut, doDelete methods and practical examples.Servlets JSPJSP IntroductionComplete introduction to JavaServer Pages (JSP) - how JSP works, JSP lifecycle, scripting elements, implicit objects, and building dynamic web pages.Servlets JSPJSP Tags and JSTLComplete guide to JSP tags including standard actions, JSTL core tags, formatting tags, SQL tags, custom tags, and tag files for building maintainable JSP applications.Servlets JSPMVC ArchitectureComplete guide to Model-View-Controller (MVC) pattern in Java web applications - implementing MVC with Servlets and JSP, Front Controller pattern, and practical examples.

PreviousTransaction Management in JDBC NextExpression Language (EL)

Java Notes

Cookies in Servlets

Complete guide to handling cookies in Java Servlets - creating, reading, modifying, deleting cookies, cookie attributes, and security best practices.

What are Cookies?

Creating and Sending Cookies

java example

@WebServlet("/set-cookie")
public class SetCookieServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String username = request.getParameter("username");
        String theme = request.getParameter("theme");

        // Create cookies
        Cookie userCookie = new Cookie("username", username);
        Cookie themeCookie = new Cookie("theme", theme);
        Cookie visitCookie = new Cookie("lastVisit", String.valueOf(System.currentTimeMillis()));

        // Set cookie properties
        userCookie.setMaxAge(60 * 60 * 24 * 7);  // 7 days
        userCookie.setPath("/");                    // Available to entire app
        userCookie.setHttpOnly(true);              // Not accessible via JavaScript
        userCookie.setSecure(true);                // Only sent over HTTPS

        themeCookie.setMaxAge(60 * 60 * 24 * 30); // 30 days
        themeCookie.setPath("/");

        visitCookie.setMaxAge(60 * 60 * 24 * 365); // 1 year
        visitCookie.setPath("/");

        // Add cookies to response
        response.addCookie(userCookie);
        response.addCookie(themeCookie);
        response.addCookie(visitCookie);

        response.setContentType("text/html");
        response.getWriter().println("<h2>Cookies Set Successfully!</h2>");
        response.getWriter().println("<p>Username: " + username + "</p>");
        response.getWriter().println("<a href=\"/read-cookie\">Read Cookies</a>");
    }
}

Reading Cookies

Example

Modifying Cookies

java example

@WebServlet("/update-cookie")
public class UpdateCookieServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // To modify a cookie, create a new one with same name
        String newTheme = request.getParameter("theme");

        Cookie themeCookie = new Cookie("theme", newTheme);
        themeCookie.setMaxAge(60 * 60 * 24 * 30); // Must reset max age
        themeCookie.setPath("/");                    // Must set same path

        response.addCookie(themeCookie); // Overwrites existing cookie

        response.setContentType("text/html");
        response.getWriter().println("<h2>Theme updated to: " + newTheme + "</h2>");
    }
}

Deleting Cookies

java example

@WebServlet("/delete-cookie")
public class DeleteCookieServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // To delete a cookie: set maxAge to 0
        Cookie userCookie = new Cookie("username", "");
        userCookie.setMaxAge(0);    // Immediately expires
        userCookie.setPath("/");     // MUST match the original path!
        response.addCookie(userCookie);

        // Delete theme cookie
        Cookie themeCookie = new Cookie("theme", "");
        themeCookie.setMaxAge(0);
        themeCookie.setPath("/");
        response.addCookie(themeCookie);

        response.setContentType("text/html");
        response.getWriter().println("<h2>Cookies Deleted!</h2>");
        response.getWriter().println("<a href=\"/read-cookie\">Verify</a>");
    }
}

⚠️ Critical: When deleting a cookie, the name and path must match exactly. If the original cookie was set with path=/app, you must delete it with path=/app.

Attribute	Method	Description
Name	Constructor	Cookie identifier (required)
Value	`setValue()`	Cookie data
Max-Age	`setMaxAge()`	Lifetime in seconds (-1 = session)
Path	`setPath()`	URL path scope
Domain	`setDomain()`	Domain scope
Secure	`setSecure(true)`	HTTPS only
HttpOnly	`setHttpOnly(true)`	No JavaScript access

Max-Age Values

Value	Meaning
Positive (e.g., 3600)	Cookie lives for that many seconds
0	Delete cookie immediately
-1 (default)	Session cookie (deleted when browser closes)

java example

@WebServlet("/login")
public class LoginServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        // Check if remember-me cookie exists
        String savedUser = getCookieValue(request, "remember_user");
        String savedToken = getCookieValue(request, "remember_token");

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        if (savedUser != null && validateToken(savedUser, savedToken)) {
            // Auto-login
            HttpSession session = request.getSession();
            session.setAttribute("loggedInUser", savedUser);
            response.sendRedirect("/dashboard");
        } else {
            // Show login form
            out.println("<form method=\"POST\" action=\"/login\">");
            out.println("<input name=\"username\" placeholder=\"Username\"><br>");
            out.println("<input type=\"password\" name=\"password\" placeholder=\"Password\"><br>");
            out.println("<label><input type=\"checkbox\" name=\"remember\"> Remember me</label><br>");
            out.println("<button type=\"submit\">Login</button>");
            out.println("</form>");
        }
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String username = request.getParameter("username");
        String password = request.getParameter("password");
        String remember = request.getParameter("remember");

        if (authenticate(username, password)) {
            // Create session
            HttpSession session = request.getSession();
            session.setAttribute("loggedInUser", username);

            // Set remember-me cookies if checked
            if ("on".equals(remember)) {
                String token = generateSecureToken();

                Cookie userCookie = new Cookie("remember_user", username);
                userCookie.setMaxAge(60 * 60 * 24 * 30); // 30 days
                userCookie.setHttpOnly(true);
                userCookie.setSecure(true);
                userCookie.setPath("/");

                Cookie tokenCookie = new Cookie("remember_token", token);
                tokenCookie.setMaxAge(60 * 60 * 24 * 30);
                tokenCookie.setHttpOnly(true);
                tokenCookie.setSecure(true);
                tokenCookie.setPath("/");

                response.addCookie(userCookie);
                response.addCookie(tokenCookie);

                // Store token in database for validation
                saveTokenToDatabase(username, token);
            }

            response.sendRedirect("/dashboard");
        } else {
            response.sendRedirect("/login?error=invalid");
        }
    }

    private String getCookieValue(HttpServletRequest request, String name) {
        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
            for (Cookie c : cookies) {
                if (c.getName().equals(name)) return c.getValue();
            }
        }
        return null;
    }

    private boolean authenticate(String user, String pass) {
        // Check against database
        return "admin".equals(user) && "password123".equals(pass);
    }

    private boolean validateToken(String user, String token) {
        // Validate token from database
        return token != null && !token.isEmpty();
    }

    private String generateSecureToken() {
        return java.util.UUID.randomUUID().toString();
    }

    private void saveTokenToDatabase(String user, String token) {
        // Save to DB in real application
    }
}

Practice	Why
Set `HttpOnly=true`	Prevents XSS attacks from reading cookies
Set `Secure=true`	Cookie only sent over HTTPS
Set `SameSite=Strict`	Prevents CSRF attacks
Short expiration	Limits exposure window
Don't store sensitive data	Cookies are visible to user
Encrypt values	Protect against tampering
Validate on server	Never trust client data

Cookies vs Sessions

Feature	Cookies	Sessions
Storage	Client browser	Server memory
Size limit	4KB per cookie	No practical limit
Security	Less secure (visible)	More secure (server-side)
Lifetime	Configurable	Until timeout/invalidation
Performance	No server memory used	Uses server memory
Data type	Strings only	Any Java object

Common Mistakes

Not matching path when deleting — Cookie won't be deleted
Storing passwords in cookies — Never store sensitive data in cookies
Not encoding cookie values — Special characters break cookies
Exceeding 4KB limit — Browser silently drops oversized cookies
Forgetting HttpOnly for auth cookies — XSS vulnerability

Interview Key Points

Cookies are small data pieces stored on the client browser
Maximum size: 4KB per cookie, typically 20 cookies per domain
setMaxAge(0) deletes; setMaxAge(-1) makes session cookie
HttpOnly prevents JavaScript access (XSS protection)
Secure flag ensures HTTPS-only transmission
Cookies are sent with EVERY request to the matching domain/path

Summary

In this chapter, we learned about Cookies in Servlets in detail. Here are the key points:

Basic introduction to the concept and why it is needed
Syntax and structure with complete examples
Internal working and best practices
Real-world applications and use cases
Common mistakes and how to avoid them
How this topic is asked in interviews

To practice these concepts, write and run the code in your IDE and verify the output. Modify each example and experiment so that you deeply understand the concept.

Exam Focus

Revise definitions, diagrams, examples, and short-answer points for Cookies in Servlets.

Interview Use

Prepare one clear explanation, one practical example, and one common mistake for this Java Master Course topic.

Search Terms

java-master-course, java master course, java, master, course, servlets, jsp, cookies

Continue learning this concept

PreviousTransaction Management in JDBC NextExpression Language (EL)

What are Cookies?

Creating and Sending Cookies

Reading Cookies

Modifying Cookies

Deleting Cookies

Cookie Attributes Reference

Max-Age Values

Practical Example: Remember Me Login

Cookie Security Best Practices

Cookies vs Sessions

Common Mistakes

Interview Key Points

Summary

Continue learning this concept

What are Cookies?

Creating and Sending Cookies

Reading Cookies

Modifying Cookies

Deleting Cookies

Cookie Attributes Reference

Max-Age Values

Practical Example: Remember Me Login

Cookie Security Best Practices

Cookies vs Sessions

Common Mistakes

Interview Key Points

Summary

Continue learning this concept