org.broadleafcommerce.common.security.util

Interface CookieUtils

All Known Implementing Classes:

GenericCookieUtilsImpl

public interface CookieUtils

Field Summary

Fields

Modifier and Type	Field and Description
static String	CUSTOMER_COOKIE_NAME

Method Summary

Modifier and Type	Method and Description
String	getCookieValue(javax.servlet.http.HttpServletRequest request, String cookieName)
void	invalidateCookie(javax.servlet.http.HttpServletResponse response, String cookieName)
void	setCookieValue(javax.servlet.http.HttpServletResponse response, String cookieName, String cookieValue)
void	setCookieValue(javax.servlet.http.HttpServletResponse response, String cookieName, String cookieValue, String path, Integer maxAge, Boolean isSecure) Uses a cookie value of "CookieInvalidationPlaceholderValue" because the later call to ESAPI#httpUtilities()#addHeader(HttpServletResponse, String, String) fails if the value is null or an empty String.
Boolean	shouldUseSecureCookieIfApplicable() Checks cookies.use.secure System Property, which determines whether to use HTTPS cookie over HTTPS connection or HTTP only.

Field Detail

CUSTOMER_COOKIE_NAME

static final String CUSTOMER_COOKIE_NAME

See Also:

Constant Field Values

Method Detail

shouldUseSecureCookieIfApplicable

Boolean shouldUseSecureCookieIfApplicable()

Checks cookies.use.secure System Property, which determines whether to use HTTPS cookie over HTTPS connection or HTTP only.

Returns:

value of cookies.use.secure

getCookieValue

String getCookieValue(javax.servlet.http.HttpServletRequest request,
                      String cookieName)

setCookieValue

void setCookieValue(javax.servlet.http.HttpServletResponse response,
                    String cookieName,
                    String cookieValue,
                    String path,
                    Integer maxAge,
                    Boolean isSecure)

Uses a cookie value of "CookieInvalidationPlaceholderValue" because the later call to ESAPI#httpUtilities()#addHeader(HttpServletResponse, String, String) fails if the value is null or an empty String. If an empty cookie value is passed, this is considered a request to remove the cookie and maxAge is set to 0 to force the removal. In addition, calls to ESAPI#httpUtilities()#killCookie(HttpServletRequest, HttpServletResponse, String) have shown to be ineffective while this approach for removing cookies works.

Parameters:

response -

cookieName -

cookieValue -

path -

maxAge -

isSecure -

setCookieValue

void setCookieValue(javax.servlet.http.HttpServletResponse response,
                    String cookieName,
                    String cookieValue)

invalidateCookie

void invalidateCookie(javax.servlet.http.HttpServletResponse response,
                      String cookieName)