• It is a binding  sent by the server back to the client for storage
• The client then when returning to a web-site (i.e. the server), can send this binding back to the same server as a reminder (storing transactions, preferences, etc)
• see description of setDomain() and setPath() methods of a Cookie to understand how the client's browser know to what URLs it should send what Cookies!!!
• Cookies can persist on the client machine across reboots.
• Can give a lifetime to a cookie, at which time it is deleted on the client machine.

Binding

• Key=Value pair.  This is text information only.

E.g.   Handle=grewe
• A Cookie only stores one Key/Value (or Name/Value) pair!!!

• Store identifcation information for E-commerce, etc.
• Low-security method of retaining password information....without explicitly asking for password each time user visits site.
• Customization of a site, possibly remember last order or pages visited on site, and when user returns to web-site anew, present them with similar information highlighted. 
• Focus Advertising, based on previous purchases,etc.

• Limited number of cookies a browser will accept per site (e.g. 20)
• Limited number of total cookies a browser will  accept (e.g. 300).
• Limited amout of storage given to each cookie.
• These are a function of browser and version of it...search documentation on browsers for detail.
• Some people find cookies invade their privacy, and there is the option on most browsers to disable their use...so you can't count on being able to use them.
• Sites that save critical information like credit card numbers, etc. in a cookie pose security problems.

Secure Cookies

Cookies have a secure flag, indicating that the cookie should only be sent over a secure channel. The rationale is as follows: supposing that we set a session ID cookie in response to the user logging in over a secure connection. Since the session ID is what to the server "represents" the user name and password, we don't want that session ID to ever be sent over an insecure connection and be vulnerable to eavesdropping. Setting the secure flag asks the client not to ever send that cookie over an insecure connection. In theory, "secure" and "insecure" are left to the interpretation of individual clients, but in practice "secure" means "HTTPS connection".

CookieObject.setSecure(true)

Of course, setting setSecure() doesn't magically turn insecure connections into secure connections. It indicates to browser not to send this cookie if connection not secure. In order to set up a secure connection, you have to make sure that the client is making an HTTPS request and that your server is set up to deal with HTTPS.

 

 

Suppose there is an HTML form that asks the user for their choice of a handle that will be used on the site which allows chat.  This will be used to identify the user to other people on the chat.  When the client submits the handle information, we want to invoke a Java Servlet that will in turn create a Cookie with this information stored.  This is useful, so that if the user returns to the web-site, they do not have to enter in this information again. 1) Create HTML form that upon submit invokes a Sevlet 2) Servlet, reads in handle parameter sent to it and creates a cookie which it sends to the client. 3) TIME PASSES including possible client reboots. 4) Client returns to web-site, and this time sends the cookie. 5) Server processes the request this time with the information in the cookie it received.

 

This Servlet is responsible for accepting and using the cookie generated in the Creating a Cookie Example above.  Specifically, it will look for the appropriate cookie that has the user's pre-specified handle and greet them using it. 1)  Servlet, accepts any cookies past to it and looks for the one in the above example. 3) It uses the value bound to this cookie as a handle to greet the client with in a generated HTML page it returns to the client.