'Handle Secure Cookie with HttpURLConnection and Domain

I would need to exchange with my backend server a Cookie with Secure, HttpOnly and Domain flags.

Here the code I'm using for the client:

CookieManager cookieManager = new CookieManager();
HttpCookie cookie = new HttpCookie("SESSION", session);            
cookie.setDomain("example.com");
cookie.setPath("/");
cookie.setSecure(true);
cookie.setHttpOnly(true);
cookie.setMaxAge(1000);
cookieManager.getCookieStore().add(new URI("https://example.com"), cookie);            
CookieHandler.setDefault(cookieManager);
....
HttpURLConnection con = (HttpURLConnection) url.openConnection();

and on the servlet side I'm using:

Cookie[] cookie = request.getCookies();
    for (int i = 0; i < cookie.length; i++) {
        log.debug("Cookie: " + cookie[i].getName() + " " + cookie[i].getValue());
        if (cookie[i].getName().equals("SESSION")) {
            log.debug("Received session: " + cookie[i].getValue());
            log.debug("is secured ?: "+cookie[i].getSecure());
            log.debug("Max age: "+cookie[i].getMaxAge());
            log.debug("Domain: "+cookie[i].getDomain());
            tokenUser = cookie[i].getValue();
        }
    }

I can retrieve the Cookie SESSION but flags Secure, HttpOnly or Domain are not set (in fact I only get the value of the token).

How can I ensure that Cookie received on the server side are set correctly ? may be I'm missing something ?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source