Interface SessionCookieConfig
-
public interface SessionCookieConfig
Class that may be used to configure various properties of cookies used for session tracking purposes.An instance of this class is acquired by a call to
ServletContext.getSessionCookieConfig()
.- Since:
- Servlet 3.0
-
-
Method Summary
All Methods Instance Methods Abstract Methods Modifier and Type Method Description java.lang.String
getComment()
Gets the comment that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.java.lang.String
getDomain()
Gets the domain name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.int
getMaxAge()
Gets the lifetime (in seconds) of the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.java.lang.String
getName()
Gets the name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.java.lang.String
getPath()
Gets the path that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.boolean
isHttpOnly()
Checks if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired will be marked as HttpOnly.boolean
isSecure()
Checks if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired will be marked as secure even if the request that initiated the corresponding session is using plain HTTP instead of HTTPS.void
setComment(java.lang.String comment)
Sets the comment that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.void
setDomain(java.lang.String domain)
Sets the domain name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.void
setHttpOnly(boolean httpOnly)
Marks or unmarks the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired as HttpOnly.void
setMaxAge(int maxAge)
Sets the lifetime (in seconds) for the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.void
setName(java.lang.String name)
Sets the name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.void
setPath(java.lang.String path)
Sets the path that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.void
setSecure(boolean secure)
Marks or unmarks the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired as secure.
-
-
-
Method Detail
-
setName
void setName(java.lang.String name)
Sets the name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.NOTE: Changing the name of session tracking cookies may break other tiers (for example, a load balancing frontend) that assume the cookie name to be equal to the default
JSESSIONID
, and therefore should only be done cautiously.- Parameters:
name
- the cookie name to use- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized
-
getName
java.lang.String getName()
Gets the name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.By default,
JSESSIONID
will be used as the cookie name.- Returns:
- the cookie name set via
setName(java.lang.String)
, ornull
ifsetName(java.lang.String)
was never called - See Also:
Cookie.getName()
-
setDomain
void setDomain(java.lang.String domain)
Sets the domain name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Parameters:
domain
- the cookie domain to use- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setDomain(String)
-
getDomain
java.lang.String getDomain()
Gets the domain name that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Returns:
- the cookie domain set via
setDomain(java.lang.String)
, ornull
ifsetDomain(java.lang.String)
was never called - See Also:
Cookie.getDomain()
-
setPath
void setPath(java.lang.String path)
Sets the path that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Parameters:
path
- the cookie path to use- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setPath(String)
-
getPath
java.lang.String getPath()
Gets the path that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.By default, the context path of the
ServletContext
from which thisSessionCookieConfig
was acquired will be used.- Returns:
- the cookie path set via
setPath(java.lang.String)
, ornull
ifsetPath(java.lang.String)
was never called - See Also:
Cookie.getPath()
-
setComment
void setComment(java.lang.String comment)
Sets the comment that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.As a side effect of this call, the session tracking cookies will be marked with a
Version
attribute equal to1
.- Parameters:
comment
- the cookie comment to use- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setComment(String)
,Cookie.getVersion()
-
getComment
java.lang.String getComment()
Gets the comment that will be assigned to any session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Returns:
- the cookie comment set via
setComment(java.lang.String)
, ornull
ifsetComment(java.lang.String)
was never called - See Also:
Cookie.getComment()
-
setHttpOnly
void setHttpOnly(boolean httpOnly)
Marks or unmarks the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired as HttpOnly.A cookie is marked as
HttpOnly
by adding theHttpOnly
attribute to it. HttpOnly cookies are not supposed to be exposed to client-side scripting code, and may therefore help mitigate certain kinds of cross-site scripting attacks.- Parameters:
httpOnly
- true if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired shall be marked as HttpOnly, false otherwise- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setHttpOnly(boolean)
-
isHttpOnly
boolean isHttpOnly()
Checks if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired will be marked as HttpOnly.- Returns:
- true if the session tracking cookies created on behalf of
the application represented by the
ServletContext
from which thisSessionCookieConfig
was acquired will be marked as HttpOnly, false otherwise - See Also:
Cookie.isHttpOnly()
-
setSecure
void setSecure(boolean secure)
Marks or unmarks the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired as secure.One use case for marking a session tracking cookie as
secure
, even though the request that initiated the session came over HTTP, is to support a topology where the web container is front-ended by an SSL offloading load balancer. In this case, the traffic between the client and the load balancer will be over HTTPS, whereas the traffic between the load balancer and the web container will be over HTTP.- Parameters:
secure
- true if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired shall be marked as secure even if the request that initiated the corresponding session is using plain HTTP instead of HTTPS, and false if they shall be marked as secure only if the request that initiated the corresponding session was also secure- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setSecure(boolean)
,ServletRequest.isSecure()
-
isSecure
boolean isSecure()
Checks if the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired will be marked as secure even if the request that initiated the corresponding session is using plain HTTP instead of HTTPS.- Returns:
- true if the session tracking cookies created on behalf of the
application represented by the
ServletContext
from which thisSessionCookieConfig
was acquired will be marked as secure even if the request that initiated the corresponding session is using plain HTTP instead of HTTPS, and false if they will be marked as secure only if the request that initiated the corresponding session was also secure - See Also:
Cookie.getSecure()
,ServletRequest.isSecure()
-
setMaxAge
void setMaxAge(int maxAge)
Sets the lifetime (in seconds) for the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Parameters:
maxAge
- the lifetime (in seconds) of the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.- Throws:
java.lang.IllegalStateException
- if theServletContext
from which thisSessionCookieConfig
was acquired has already been initialized- See Also:
Cookie.setMaxAge(int)
-
getMaxAge
int getMaxAge()
Gets the lifetime (in seconds) of the session tracking cookies created on behalf of the application represented by theServletContext
from which thisSessionCookieConfig
was acquired.By default,
-1
is returned.- Returns:
- the lifetime (in seconds) of the session tracking
cookies created on behalf of the application represented by the
ServletContext
from which thisSessionCookieConfig
was acquired, or-1
(the default) - See Also:
Cookie.getMaxAge()
-
-