43

I would like to take a Cookie string (as it might be returned in a Set-Cookie header) and be able to easily modify parts of it, specifically the expiration date.

I see there are several different Cookie classes, such as BasicClientCookie, available but I don't see any easy way to parse the string into one of those objects.

I see in api level 9 they added HttpCookie which has a parse method, but I need something to work in previous versions.

Any ideas?

Thanks

2
  • What HTTP client are you using? Android ships with Apache Commons HttpClient.
    – BalusC
    Apr 7, 2011 at 1:13
  • I am using HttpClient for connections but I have been using CookieSyncManager for persisting the cookies. I'm not using the HttpClient's CookieStore at the moment. Apr 7, 2011 at 1:43

9 Answers 9

120

How about java.net.HttpCookie:

List<HttpCookie> cookies = HttpCookie.parse(header);
6
  • 3
    This is what the OP was referring to as not being available until api 9.
    – Matt Wolfe
    Nov 19, 2013 at 0:36
  • 8
    @MattWolfe Correct, but 90% of the people who find this question in 2009 do not worry about API 9 any more. That's why this answer is being upvoted now. Jul 17, 2015 at 21:07
  • 5
    Fails for a value like: SSID PHPSESSID=d6cb3d4a5e6fd3bbe5078f37d616fac1; path=/, ci_session=a%3A0%3A%7B%7D; expires=Mon, 10-Nov-2014 12:37:06 GMT; Max-Age=-31500000; path=/, ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22ca963cd5e9b6d9631c5afc8f26eb7374%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A14%3A%22182.59.202.107%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A60%3A%22Dalvik%2F2.1.0+%28Linux%3B+U%3B+Android+5.1.1%3B+Nexus+5+Build%2FLMY48B%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1447123026%3Bs%3A9%3A%22user_data%22%3Bs
    – User3
    Nov 10, 2015 at 2:37
  • 14
    This method can not parse right cookies... Don't use it!
    – atasoyh
    Nov 11, 2016 at 9:54
  • 4
    @User3: The cookie you've posted violates RFC 2109 §4.1 which reads token (informally) – a sequence of non-special, non-white space characters, so SSID PHPSESSID should not contain a space. @atasoyh: Would be nice to see a concrete example...
    – dma_k
    Dec 19, 2017 at 15:12
18

I believe you'll have to parse it out manually. Try this:

BasicClientCookie parseRawCookie(String rawCookie) throws Exception {
    String[] rawCookieParams = rawCookie.split(";");

    String[] rawCookieNameAndValue = rawCookieParams[0].split("=");
    if (rawCookieNameAndValue.length != 2) {
        throw new Exception("Invalid cookie: missing name and value.");
    }

    String cookieName = rawCookieNameAndValue[0].trim();
    String cookieValue = rawCookieNameAndValue[1].trim();
    BasicClientCookie cookie = new BasicClientCookie(cookieName, cookieValue);
    for (int i = 1; i < rawCookieParams.length; i++) {
        String rawCookieParamNameAndValue[] = rawCookieParams[i].trim().split("=");

        String paramName = rawCookieParamNameAndValue[0].trim();

        if (paramName.equalsIgnoreCase("secure")) {
            cookie.setSecure(true);
        } else {
            if (rawCookieParamNameAndValue.length != 2) {
                throw new Exception("Invalid cookie: attribute not a flag or missing value.");
            }

            String paramValue = rawCookieParamNameAndValue[1].trim();

            if (paramName.equalsIgnoreCase("expires")) {
                Date expiryDate = DateFormat.getDateTimeInstance(DateFormat.FULL)
                        .parse(paramValue);
                cookie.setExpiryDate(expiryDate);
            } else if (paramName.equalsIgnoreCase("max-age")) {
                long maxAge = Long.parseLong(paramValue);
                Date expiryDate = new Date(System.getCurrentTimeMillis() + maxAge);
                cookie.setExpiryDate(expiryDate);
            } else if (paramName.equalsIgnoreCase("domain")) {
                cookie.setDomain(paramValue);
            } else if (paramName.equalsIgnoreCase("path")) {
                cookie.setPath(paramValue);
            } else if (paramName.equalsIgnoreCase("comment")) {
                cookie.setPath(paramValue);
            } else {
                throw new Exception("Invalid cookie: invalid attribute name.");
            }
        }
    }

    return cookie;
}

I haven't actually compiled or run this code, but it should be a strong start. You'll probably have to mess with the date parsing a bit: I'm not sure that the date format used in cookies is actually the same as DateFormat.FULL. (Check out this related question, which addresses handling the date format in cookies.) Also, note that there are some cookie attributes not handled by BasicClientCookie such as version and httponly.

Finally, this code assumes that the name and value of the cookie appear as the first attribute: I'm not sure if that's necessarily true, but that's how every cookie I've ever seen is ordered.

5
  • after if (paramName.equalsIgnoreCase("comment")), cookie.setPath(paramValue) is probably wrong?
    – Jonas N
    Sep 12, 2012 at 11:39
  • 1
    Better to do what @yanchenko suggested and use what comes in the native libraries. Use one of the CookieSpec superclasses like BestMatchSpec Jan 22, 2013 at 20:15
  • 1
    This will break if the cookie values has "=" character in value
    – Nandish A
    Sep 8, 2015 at 11:34
  • How can I get cookie value that it contains "=" character?
    – Trong Tran
    Apr 4, 2016 at 7:56
  • 1
    does anybody have a solution to handle the cookies with the "=" in them? Dec 30, 2016 at 23:00
8

You can use Apache HttpClient's facilities for that.
Here's an excerpt from CookieJar:

CookieSpec cookieSpec = new BrowserCompatSpec();

List<Cookie> parseCookies(URI uri, List<String> cookieHeaders) {
    ArrayList<Cookie> cookies = new ArrayList<Cookie>();
    int port = (uri.getPort() < 0) ? 80 : uri.getPort();
    boolean secure = "https".equals(uri.getScheme());
    CookieOrigin origin = new CookieOrigin(uri.getHost(), port,
            uri.getPath(), secure);
    for (String cookieHeader : cookieHeaders) {
        BasicHeader header = new BasicHeader(SM.SET_COOKIE, cookieHeader);
        try {
            cookies.addAll(cookieSpec.parse(header, origin));
        } catch (MalformedCookieException e) {
            L.d(e);
        }
    }
    return cookies;
}
7

Funny enough, but java.net.HttpCookie class cannot parse cookie strings with domain and/or path parts that this exact java.net.HttpCookie class has converted to strings.

For example:

HttpCookie newCookie = new HttpCookie("cookieName", "cookieValue");
newCookie.setDomain("cookieDomain.com");
newCookie.setPath("/");

As this class implements neither Serializable nor Parcelable, it's tempting to store cookies as strings. So you write something like:

saveMyCookieAsString(newCookie.toString());

This statement will save the cookie in the following format:

cookieName="cookieValue";$Path="/";$Domain="cookiedomain.com"

And then you want to restore this cookie, so you get the string:

String cookieAsString = restoreMyCookieString();

and try to parse it:

List<HttpCookie> cookiesList = HttpCookie.parse(cookieAsString);
StringBuilder myCookieAsStringNow = new StringBuilder();
for(HttpCookie httpCookie: cookiesList) {
    myCookieAsStringNow.append(httpCookie.toString());
}

now myCookieAsStringNow.toString(); produces

cookieName=cookieValue

Domain and path parts are just gone. The reason: parse method is case sensitive to words like "domain" and "path".
Possible workaround: provide another toString() method like:

public static String httpCookieToString(HttpCookie httpCookie) {
    StringBuilder result = new StringBuilder()
            .append(httpCookie.getName())
            .append("=")
            .append("\"")
            .append(httpCookie.getValue())
            .append("\"");

    if(!TextUtils.isEmpty(httpCookie.getDomain())) {
        result.append("; domain=")
                .append(httpCookie.getDomain());
    }
    if(!TextUtils.isEmpty(httpCookie.getPath())){
        result.append("; path=")
                .append(httpCookie.getPath());
    }

    return result.toString();
}

I find it funny (especially, for classes like java.net.HttpCookie which are aimed to be used by a lot and lot of people) and I hope it will be useful for someone.

1
  • 4
    It seems that HttpCookie parses cookies as server cookies, but stringifies them as user-agent cookies – perhaps that was the intention as its JavaDoc reads: carries state information between server and user agent. See also examples section of RFC 2109.
    – dma_k
    Dec 19, 2017 at 14:00
6

With a regular expression like :

([^=]+)=([^\;]+);\s?

you can parse a cookie like this :

.COOKIEAUTH=5DEF0BF530F749AD46F652BDF31C372526A42FEB9D40162167CB39C4D43FC8AF1C4B6DF0C24ECB1945DFF7952C70FDA1E4AF12C1803F9D089E78348C4B41802279897807F85905D6B6D2D42896BA2A267E9F564814631B4B31EE41A483C886B14B5A1E76FD264FB230E87877CB9A4A2A7BDB0B0101BC2C1AF3A029CC54EE4FBC; 
expires=Sat, 30-Jul-2011 01:22:34 GMT; 
path=/; HttpOnly

in a few lines of code.

2

If you happen to have Netty HTTP codec installed, you can also use io.netty.handler.codec.http.cookie.ServerCookieDecoder.LAX|STRICT. Very convenient.

0

The advantage of Yanchenko's approach with Apache Http client is that is validates the cookies consistent with the spec based on the origin. The regular expression approach won't do that, but perhaps you don't need to.

public class CookieUtil {

    public List<Cookie> parseCookieString(String cookies) {
        List<Cookie> cookieList = new ArrayList<Cookie>();
        Pattern cookiePattern = Pattern.compile("([^=]+)=([^\\;]*);?\\s?");
        Matcher matcher = cookiePattern.matcher(cookies);
        while (matcher.find()) {
            int groupCount = matcher.groupCount();
            System.out.println("matched: " + matcher.group(0));
            for (int groupIndex = 0; groupIndex <= groupCount; ++groupIndex) {
                System.out.println("group[" + groupIndex + "]=" + matcher.group(groupIndex));
            }
            String cookieKey = matcher.group(1);
            String cookieValue = matcher.group(2);
            Cookie cookie = new BasicClientCookie(cookieKey, cookieValue);
            cookieList.add(cookie);
        }
        return cookieList;
    }
}

I've attached a small example using yanchenkos regex. It needs to be tweaked just a little. Without the '?' quantity modifer on the trailing ';' the trailing attribute for any cookie will not be matched. After that, if you care about the other attributes you can use Doug's code, properly encapsulated, to parse the other match groups.

Edit: Also, note '*' qualifier on the value of the cookie itself. Values are optional and you can get cookies like "de=", i.e. no value at all. Looking at the regex again, I don't think it will handle the secure and discard cookie attributes which do not have an '='.

0

If you want to parse to javax.servlet.http.Cookie, you may first parse to java.net.HttpCookie and then convert to Cookie. But theoretically it's may be incompatible because of cookie's version.

    HttpCookie httpCookie = ...
    Cookie cookie = toServletCookie(httpCookie);
    
    private static boolean isNotEmpty(String str) {
        return !(str == null || str.trim().isEmpty());
    }

    public static Cookie toServletCookie(HttpCookie httpCookie) {
        Cookie cookie = new Cookie(httpCookie.getName(), httpCookie.getValue());
        if (isNotEmpty(httpCookie.getDomain())) {
            cookie.setDomain(httpCookie.getDomain());
        }
        if (isNotEmpty(httpCookie.getPath())) {
            cookie.setPath(httpCookie.getPath());
        }
        cookie.setHttpOnly(httpCookie.isHttpOnly());
        cookie.setSecure(httpCookie.getSecure());
        if (isNotEmpty(httpCookie.getComment())) {
            cookie.setComment(httpCookie.getComment());
        }
        cookie.setMaxAge((int) Math.min(httpCookie.getMaxAge(), Integer.MAX_VALUE));
        return cookie;
    }
-1
CookieManager cookieManager = new CookieManager();
        CookieHandler.setDefault(cookieManager);
        HttpCookie cookie = new HttpCookie("lang", "en");
        cookie.setDomain("Your URL");
        cookie.setPath("/");
        cookie.setVersion(0);

        cookieManager.getCookieStore().add(new URI("https://Your URL/"), cookie);
        List<HttpCookie> Cookies =  cookieManager.getCookieStore().get(new URI("https://Your URL/"));
        String s = Cookies.get(0).getValue();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.