学步园

GetCookieServlet

When you get cookie from request, you can only get cookie name and value, and always:
getDomain() return null
getPath() return null
getMaxAge() return -1

Check the real cookie data in Firefox menu ""Tools -> Options -> Privacy -> Show Cookies", you can see the cookie "mycookie" domain is cityu.edu.hk and max age is 10.

Why???
Answer (from http://saloon.javaranch.com/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic&f=50&t=004445):

This happens because Kookie
API's implementation Kookie.java doesn't return us the Domain, Path,
Max Age any extra information except Kookie name,value

NOTE: I have replaced "c" from cookie to "k" everwhere to avoid the posting error I was getting...

Here is a piece of code from Kookie.java,

code:

---

public Kookie(String name, String value)
    {
        maxAge = -1;
        version = 0;
        if(!isToken(name) || name.equalsIgnoreCase("Comment") || name.equalsIgnoreCase("Discard") || name.equalsIgnoreCase("Domain") || name.equalsIgnoreCase("Expires") || name.equalsIgnoreCase("Max-Age") || name.equalsIgnoreCase("Path") || name.equalsIgnoreCase("Secure") || name.equalsIgnoreCase("Version"))
        {
            String errMsg = lStrings.getString("err.kookie_name_is_token");
            Object errArgs[] = new Object[1];
            errArgs[0] = name;
            errMsg = MessageFormat.format(errMsg, errArgs);
            throw new IllegalArgumentException(errMsg);
        } else
        {
            this.name = name;
            this.value = value;
            return;
        }
    }

---

Here what happens is- browser returns the kookie as defined per RFC 2109

Now, the webserver's code parses the kookie header separated by ";" and so gets following in the list,

name1=value1
domain=domain1
path=path1
(and other parameters like Secure, Comment etc...)
name2=value2
domain=domain2
path=path2
(and other parameters like Secure, Comment etc...)

and then tries to create Kookie object for each of such Name,Value pair after further separting by '=' sign. So, it does,
Kookie tempKookie = new Kookie(name,value);

now
the Kookie.java ignores the kookie creation if the name is Path, Domain
etc (as per the above Kookie.java) and so it only gets kookie's name
and value...

Here is
the Tomcat405's code that parses the Kookie. If we combine the
knowledge of the RFC 2109, this code and Kookie.java then we would
realize what happens here...

code:

---

/**
     * Parse a kookie header into an array of kookies according to RFC 2109.
     *
     * @param header Value of an HTTP "Kookie" header
     */
    public static Kookie[] parseKookieHeader(String header) {
        if ((header == null) || (header.length() < 1))
            return (new Kookie[0]);
        ArrayList kookies = new ArrayList();
        while (header.length() > 0) {
            int semicolon = header.indexOf(';');
            if (semicolon < 0)
                semicolon = header.length();
            if (semicolon == 0)
                break;
            String token = header.substring(0, semicolon);
            if (semicolon < header.length())
                header = header.substring(semicolon + 1);
            else
                header = "";
            try {
                int equals = token.indexOf('=');
                if (equals > 0) {
                    String name = token.substring(0, equals).trim();
                    String value = token.substring(equals+1).trim();
                    kookies.add(new Kookie(name, value));
                }
            } catch (Throwable e) {
                ;
            }
        }
        return ((Kookie[]) kookies.toArray(new Kookie[kookies.size()]));
    }

---

hope this is helpful...

and
the reason that Kookie.java ignores Domain, Path etc could be just that
it wanted to avoid providing any more information to the server as a
prevention of possible hack by some other servers. e.g.

- I have a server1, server2.

- server1 sets a kookie called "server1login" w/ domain/path etc..

-
server2 hacks the user system's browser and write a code to read
kookies that allows it to read "all" kookies set in the browser

-
now, if the reading of the kookie returned every bit of information
about the kookie then server2's code would know domain/path of server1
and can then overwrite the kookie BUT if it didn't get the domain/path
then it won't be able to overwrite the kookie and the user's
application runnin in the browser is less liable to mis-behave due to
the hack.

- Here
server2 CAN override Kookie API defined by Kookie.java and return all
the information to the user but that would violate Kookie API but to do
that we have to modify server2's servlets.jar where the Kookie.class is
there and all those things which can't be just done with a blink of
eye....

- if
server1's code wanted to modify the kookie (in case of logout if we
want to remove the kookie) then the code has to know the domain/path
etc information with which the kookie was set and that way it can do
things. AND most probably the code on server1 knows those values...

Its difficult to explain but I'm sure you won't have problem in getting what I am trying to say

Regards
Maulin