21.7 Java4570: session tracking using cookies  (Page 2/7)

What are cookies?

Cookies are information that is created by a web application and stored on the client machine by the browser. Under certain conditions, thisinformation is sent to the HTTP server whenever a request is sent from the client to the server.

Used for session tracking

Cookies are widely used by various server-side programming techniques for session tracking. Java provides classes and methods designed to allow you to usecookies in your servlets.

Which server receives a cookie?

By default, cookies are sent only to the host that caused them to be saved. Methods can be called to set attributes for each cookie that determine whichservers will receive the cookie. For example, the setDomain method can be used to specify a domain pattern indicating which servers shouldreceive a cookie.

By default, cookies are sent to the page that set the cookie and to all the pages in that directory or under that directory. This also can be modified bycalling the setPath method on the cookie.

What is the life expectancy of a cookie?

Also by default, a cookie expires when the browser exits. The setMaxAge method can be called to override the default and specify the maximum age of the cookie in seconds. The cookie will expire when the maximumage has been reached. The parameter to this method is an int so the maximum age of a cookie can be a very large number of seconds. (The maximum positive value of Java type int is 2,147,483,647. If I did the arithmetic correctly, that is about 68 years.)

Comments in a cookie

The setComment method can be used to provide a comment with the cookie. The browser may elect to make this information available to theuser.

Name and value of a cookie

The constructor sets the name and value of a cookie when the Cookie object is instantiated. The setValue method can be used to assign a new value to the cookie after it is instantiated.

Other attributes

There are a few other attributes that can be set as well. You can read about them in the Java(TM) EE 7 documentation.

Cookies can be disabled

CAUTION: The user can disable cookies in most, and perhaps all browsers. As a result, the user can defeat session tracking using cookies.

Therefore, unless you can be certain that all of your clients will operate with cookies enabled, the use of cookies for session tracking may not besatisfactory in all cases. (The fallback position may be the less-persistent Hidden Fields and/or URL Rewriting methods of session tracking.)

The Java Cookie class

The Cookie class represents a cookie that can be used for session management with the HTTP protocol.

Cookies are used to cause user agents such as web browsers to store small amounts of state associated with a user's web browsing activities.

Applications

Common applications for cookies include:

• Storing user preferences
• Automating low security user signon facilities, and
• Helping collect data used for "shopping cart" applications.

Names, values, and attributes

Each cookie has a name and a single value (a name::value pair) . As mentioned earlier, it may have optional attributes, including: