Modifier and Type | Method and Description |
---|---|
Cookie |
build()
Builds the cookie instance.
|
Cookie.Builder |
domain(String domain)
Domain=<domain-value> Optional
Host to which the cookie will be sent. |
Cookie.Builder |
expires(Date expires)
Expires=<date> Optional
The maximum lifetime of the cookie as an HTTP-date timestamp. |
Cookie.Builder |
httpOnly()
HttpOnly Optional
Forbids JavaScript from accessing the cookie, for example, through the Document.cookie property.
|
Cookie.Builder |
maxAge(int maxAge)
Max-Age=<number> Optional
Number of seconds until the cookie expires. |
Cookie.Builder |
name(String name)
A
<cookie-name> can be any US-ASCII characters, except control characters, spaces, or tabs. |
Cookie.Builder |
path(String path)
Path=<path-value> Optional
A path that must exist in the requested URL, or the browser won't send the Cookie header. |
Cookie.Builder |
sameSite(Cookie.SameSite sameSite)
SameSite=<samesite-value> Optional
Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site
request forgery attacks (CSRF). |
Cookie.Builder |
secure()
Secure Optional
Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and
therefore is more resistent to man-in-the-middle attacks.
|
Cookie.Builder |
value(String value)
A
<cookie-value> can optionally be wrapped in double quotes and include any US-ASCII characters
excluding control characters, Whitespace, double quotes, comma, semicolon, and backslash. |
public Cookie.Builder domain(@Nullable String domain)
Domain=<domain-value>
Optional
Host to which the cookie will be sent. If omitted, defaults to the host of the current document URL, not
including subdomains. Contrary to earlier specifications, leading dots in domain names (.example.com) are
ignored. Multiple host/domain values are not allowed, but if a domain is specified, then subdomains are
always included.domain
- Host to which the cookie will be sent.build()
public Cookie.Builder expires(@Nullable Date expires)
Expires=<date>
Optional
The maximum lifetime of the cookie as an HTTP-date timestamp.
If unspecified, the cookie becomes a session cookie. A session finishes when the client shuts down, and
session cookies will be removed.
Warning:
Many web browsers have a session restore feature that will save all tabs and restore them next time the
browser is used. Session cookies will also be restored, as if the browser was never closed.
When an Expires date is set, the deadline is relative to the client the cookie is being set on, not the
server.expires
- the maximum lifetime of the cookie as an HTTP-date timestampbuild()
public Cookie.Builder httpOnly()
build()
public Cookie.Builder maxAge(int maxAge)
Max-Age=<number>
Optional
Number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If
both Expires and Max-Age are set, Max-Age has precedence.maxAge
- seconds until the cookie expiresbuild()
public Cookie.Builder name(@Nullable String name)
<cookie-name>
can be any US-ASCII characters, except control characters, spaces, or tabs. It also
must not contain a separator character like the following: ( ) < > @ , ; : \ " / [ ] ? = { }
.name
- cookie namebuild()
public Cookie.Builder path(@Nullable String path)
Path=<path-value>
Optional
A path that must exist in the requested URL, or the browser won't send the Cookie header. The forward slash
(/) character is interpreted as a directory separator, and subdirectories will be matched as well: for
Path=/docs, /docs, /docs/Web/, and /docs/Web/HTTP will all match.path
- A path that must exist in the requested URL, or the browser won't send the Cookie headerbuild()
public Cookie.Builder sameSite(@Nullable Cookie.SameSite sameSite)
SameSite=<samesite-value>
Optional
Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site
request forgery attacks (CSRF).
Inline options are:
Strict:
The browser sends the cookie only for same-site requests (that is, requests originating from the same site
that set the cookie). If the request originated from a different URL than the current one, no cookies with
the SameSite=Strict attribute are sent.
Lax:
The cookie is not sent on cross-site requests, such as calls to load images or frames, but is sent when a
user is navigating to the origin site from an external site (e.g. if following a link). This is the default
behavior if the SameSite attribute is not specified.
None:
The browser sends the cookie with both cross-site and same-site requests. The Secure attribute must also be
set when SameSite=None!sameSite
- Controls whether a cookie is sent with cross-origin requests, providing some protection against
cross-site request forgery attacks (CSRF)build()
public Cookie.Builder secure()
build()
public Cookie.Builder value(@Nullable String value)
<cookie-value>
can optionally be wrapped in double quotes and include any US-ASCII characters
excluding control characters, Whitespace, double quotes, comma, semicolon, and backslash. Encoding: Many
implementations perform URL encoding on cookie values, however it is not required per the RFC specification.
It does help satisfying the requirements about which characters are allowed for <cookie-value>
though.value
- cookie valuebuild()