Details | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 771 | blopes | 1 | <!DOCTYPE html SYSTEM "about:legacy-compat"> |
| 2 | <html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="../images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 Configuration Reference (9.0.112) - The Cookie Processor Component</title></head><body><div id="wrapper"><header><div id="header"><div><div><div class="logo noPrint"><a href="https://tomcat.apache.org/"><img alt="Tomcat Home" src="../images/tomcat.png"></a></div><div style="height: 1px;"></div><div class="asfLogo noPrint"><a href="https://www.apache.org/" target="_blank"><img src="../images/asf-logo.svg" alt="The Apache Software Foundation" style="width: 266px; height: 83px;"></a></div><h1>Apache Tomcat 9 Configuration Reference</h1><div class="versionInfo"> |
||
| 3 | Version 9.0.112, |
||
| 4 | <time datetime="2025-11-06">Nov 6 2025</time></div><div style="height: 1px;"></div><div style="clear: left;"></div></div></div></div></header><div id="middle"><div><div id="mainLeft" class="noprint"><div><nav><div><h2>Links</h2><ul><li><a href="../index.html">Docs Home</a></li><li><a href="index.html">Config Ref. Home</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul></div><div><h2>Top Level Elements</h2><ul><li><a href="server.html">Server</a></li><li><a href="service.html">Service</a></li></ul></div><div><h2>Executors</h2><ul><li><a href="executor.html">Executor</a></li></ul></div><div><h2>Connectors</h2><ul><li><a href="http.html">HTTP/1.1</a></li><li><a href="http2.html">HTTP/2</a></li><li><a href="ajp.html">AJP</a></li></ul></div><div><h2>Containers</h2><ul><li><a href="context.html">Context</a></li><li><a href="engine.html">Engine</a></li><li><a href="host.html">Host</a></li><li><a href="cluster.html">Cluster</a></li></ul></div><div><h2>Nested Components</h2><ul><li><a href="cookie-processor.html">CookieProcessor</a></li><li><a href="credentialhandler.html">CredentialHandler</a></li><li><a href="globalresources.html">Global Resources</a></li><li><a href="jar-scanner.html">JarScanner</a></li><li><a href="jar-scan-filter.html">JarScanFilter</a></li><li><a href="listeners.html">Listeners</a></li><li><a href="loader.html">Loader</a></li><li><a href="manager.html">Manager</a></li><li><a href="realm.html">Realm</a></li><li><a href="resources.html">Resources</a></li><li><a href="sessionidgenerator.html">SessionIdGenerator</a></li><li><a href="valve.html">Valve</a></li></ul></div><div><h2>Cluster Elements</h2><ul><li><a href="cluster.html">Cluster</a></li><li><a href="cluster-manager.html">Manager</a></li><li><a href="cluster-channel.html">Channel</a></li><li><a href="cluster-membership.html">Channel/Membership</a></li><li><a href="cluster-sender.html">Channel/Sender</a></li><li><a href="cluster-receiver.html">Channel/Receiver</a></li><li><a href="cluster-interceptor.html">Channel/Interceptor</a></li><li><a href="cluster-valve.html">Valve</a></li><li><a href="cluster-deployer.html">Deployer</a></li><li><a href="cluster-listener.html">ClusterListener</a></li></ul></div><div><h2>web.xml</h2><ul><li><a href="filter.html">Filter</a></li></ul></div><div><h2>Other</h2><ul><li><a href="runtime-attributes.html">Runtime attributes</a></li><li><a href="systemprops.html">System properties</a></li><li><a href="jaspic.html">JASPIC</a></li></ul></div></nav></div></div><div id="mainRight"><div id="content"><h2>The Cookie Processor Component</h2><h3 id="Table_of_Contents">Table of Contents</h3><div class="text"> |
||
| 5 | <ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Attributes">Attributes</a><ol><li><a href="#Common_Attributes">Common Attributes</a></li><li><a href="#Standard_Implementation">Standard Implementation</a></li><li><a href="#Legacy_Cookie_Processor_-_org.apache.tomcat.util.http.LegacyCookieProcessor">Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor</a></li></ol></li><li><a href="#Nested_Components">Nested Components</a></li><li><a href="#Special_Features">Special Features</a></li></ul> |
||
| 6 | </div><h3 id="Introduction">Introduction</h3><div class="text"> |
||
| 7 | |||
| 8 | <p>The <strong>CookieProcessor</strong> element represents the component that |
||
| 9 | parses received cookie headers into <code>javax.servlet.http.Cookie</code> |
||
| 10 | objects accessible through <code>HttpServletRequest.getCookies()</code> and |
||
| 11 | converts <code>javax.servlet.http.Cookie</code> objects added to the response |
||
| 12 | through <code>HttpServletResponse.addCookie()</code> to the HTTP headers |
||
| 13 | returned to the client.</p> |
||
| 14 | |||
| 15 | <p>A CookieProcessor element MAY be nested inside a |
||
| 16 | <a href="context.html">Context</a> component. If it is not included, a default |
||
| 17 | implementation will be created automatically.</p> |
||
| 18 | |||
| 19 | </div><h3 id="Attributes">Attributes</h3><div class="text"> |
||
| 20 | |||
| 21 | <div class="subsection"><h4 id="Common_Attributes">Common Attributes</h4><div class="text"> |
||
| 22 | |||
| 23 | <p>All implementations of <strong>CookieProcessor</strong> support the |
||
| 24 | following attributes:</p> |
||
| 25 | |||
| 26 | <table class="defaultTable"><tr><th style="width: 15%;"> |
||
| 27 | Attribute |
||
| 28 | </th><th style="width: 85%;"> |
||
| 29 | Description |
||
| 30 | </th></tr><tr id="Attributes_Common Attributes_className"><td><code class="attributeName">className</code></td><td> |
||
| 31 | <p>Java class name of the implementation to use. This class must |
||
| 32 | implement the <code>org.apache.tomcat.util.http.CookieProcessor</code> |
||
| 33 | interface. If not specified, the standard value (defined below) will be |
||
| 34 | used.</p> |
||
| 35 | </td></tr></table> |
||
| 36 | |||
| 37 | </div></div> |
||
| 38 | |||
| 39 | |||
| 40 | <div class="subsection"><h4 id="Standard_Implementation">Standard Implementation</h4><div class="text"> |
||
| 41 | |||
| 42 | <p>The standard implementation of <strong>CookieProcessor</strong> is |
||
| 43 | <code>org.apache.tomcat.util.http.Rfc6265CookieProcessor</code>.</p> |
||
| 44 | |||
| 45 | <p>This cookie processor is based on RFC6265 with the following changes to |
||
| 46 | support better interoperability:</p> |
||
| 47 | |||
| 48 | <ul> |
||
| 49 | <li>Values 0x80 to 0xFF are permitted in cookie-octet to support the use |
||
| 50 | of UTF-8 in cookie values as used by HTML 5.</li> |
||
| 51 | <li>For cookies without a value, the '=' is not required after the name as |
||
| 52 | some browsers do not sent it.</li> |
||
| 53 | </ul> |
||
| 54 | |||
| 55 | <p>The RFC 6265 cookie processor is generally more lenient than the legacy |
||
| 56 | cookie parser. In particular:</p> |
||
| 57 | |||
| 58 | <ul> |
||
| 59 | <li>The '<code>=</code>' and '<code>/</code>' characters are always |
||
| 60 | permitted in a cookie value.</li> |
||
| 61 | <li>Name only cookies are always permitted.</li> |
||
| 62 | <li>The cookie header is always preserved.</li> |
||
| 63 | </ul> |
||
| 64 | |||
| 65 | <p>The <strong>RFC 6265 Cookie Processor</strong> supports the following |
||
| 66 | additional attributes.</p> |
||
| 67 | |||
| 68 | <table class="defaultTable"><tr><th style="width: 15%;"> |
||
| 69 | Attribute |
||
| 70 | </th><th style="width: 85%;"> |
||
| 71 | Description |
||
| 72 | </th></tr><tr id="Attributes_Standard Implementation_cookiesWithoutEquals"><td><code class="attributeName">cookiesWithoutEquals</code></td><td> |
||
| 73 | <p>Determines how a cookie received from a user agent should be |
||
| 74 | interpreted when the name value pair does not contain an equals sign. |
||
| 75 | The default value is <code>name</code> which means that the cookie will |
||
| 76 | be treated as a cookie with a name but no value. The other option is |
||
| 77 | <code>ignore</code> which means the cookie will be ignored. From Tomcat |
||
| 78 | 12 onwards the default will be <code>ignore</code>.</p> |
||
| 79 | </td></tr><tr id="Attributes_Standard Implementation_partitioned"><td><code class="attributeName">partitioned</code></td><td> |
||
| 80 | <p>Should the Partitioned flag be set on cookies? Defaults to <code>false</code>.</p> |
||
| 81 | <p>Note: The name of the attribute used to indicate a partitioned cookie as part of |
||
| 82 | <a href="https://developers.google.com/privacy-sandbox/3pcd#partitioned">CHIPS</a> is not defined by an RFC and |
||
| 83 | may change in a non-backwards compatible way once equivalent functionality is included in an RFC.</p> |
||
| 84 | </td></tr><tr id="Attributes_Standard Implementation_sameSiteCookies"><td><code class="attributeName">sameSiteCookies</code></td><td> |
||
| 85 | <p>Enables setting same-site cookie attribute.</p> |
||
| 86 | |||
| 87 | <p>If value is <code>unset</code> then the same-site cookie attribute |
||
| 88 | won't be set. This is the default value.</p> |
||
| 89 | |||
| 90 | <p>If value is <code>none</code> then the same-site cookie attribute |
||
| 91 | will be set and the cookie will always be sent in cross-site requests.</p> |
||
| 92 | |||
| 93 | <p>If value is <code>lax</code> then the browser only sends the cookie |
||
| 94 | in same-site requests and cross-site top level GET requests.</p> |
||
| 95 | |||
| 96 | <p>If value is <code>strict</code> then the browser prevents sending the |
||
| 97 | cookie in any cross-site request.</p> |
||
| 98 | </td></tr></table> |
||
| 99 | |||
| 100 | </div></div> |
||
| 101 | |||
| 102 | <div class="subsection"><h4 id="Legacy_Cookie_Processor_-_org.apache.tomcat.util.http.LegacyCookieProcessor">Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor</h4><div class="text"> |
||
| 103 | |||
| 104 | <p>This is the legacy cookie parser based on RFC6265, RFC2109 and RFC2616. |
||
| 105 | It implements a strict interpretation of the cookie specifications. Due to |
||
| 106 | various interoperability issues with browsers not all strict behaviours |
||
| 107 | are enabled by default and additional options are available to further |
||
| 108 | relax the behaviour of this cookie processor if required.</p> |
||
| 109 | |||
| 110 | <table class="defaultTable"><tr><th style="width: 15%;"> |
||
| 111 | Attribute |
||
| 112 | </th><th style="width: 85%;"> |
||
| 113 | Description |
||
| 114 | </th></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_allowEqualsInValue"><td><code class="attributeName">allowEqualsInValue</code></td><td> |
||
| 115 | <p>If this is <code>true</code> Tomcat will allow '<code>=</code>' |
||
| 116 | characters when parsing unquoted cookie values. If <code>false</code>, |
||
| 117 | cookie values containing '<code>=</code>' will be terminated when the |
||
| 118 | '<code>=</code>' is encountered and the remainder of the cookie value |
||
| 119 | will be dropped.</p> |
||
| 120 | <p>If not set the specification compliant default value of |
||
| 121 | <code>false</code> will be used.</p> |
||
| 122 | </td></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_allowHttpSepsInV0"><td><code class="attributeName">allowHttpSepsInV0</code></td><td> |
||
| 123 | <p>If this is <code>true</code> Tomcat will allow HTTP separators in |
||
| 124 | cookie names and values.</p> |
||
| 125 | <p>If not specified, the default specification compliant value of |
||
| 126 | <code>false</code> will be used.</p> |
||
| 127 | </td></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_allowNameOnly"><td><code class="attributeName">allowNameOnly</code></td><td> |
||
| 128 | <p>If this is <code>true</code> Tomcat will allow name only cookies |
||
| 129 | (with or without trailing '<code>=</code>') when parsing cookie headers. |
||
| 130 | If <code>false</code>, name only cookies will be dropped.</p> |
||
| 131 | <p>If not set the specification compliant default value of |
||
| 132 | <code>false</code> will be used.</p> |
||
| 133 | </td></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_alwaysAddExpires"><td><code class="attributeName">alwaysAddExpires</code></td><td> |
||
| 134 | <p>If this is <code>true</code> Tomcat will always add an expires |
||
| 135 | parameter to a SetCookie header even for cookies with version greater |
||
| 136 | than zero. This is to work around a known IE6 and IE7 bug that causes I |
||
| 137 | to ignore the Max-Age parameter in a SetCookie header.</p> |
||
| 138 | <p>If <code>org.apache.catalina.STRICT_SERVLET_COMPLIANCE</code> is set |
||
| 139 | to <code>true</code>, the default of this setting will be |
||
| 140 | <code>false</code>, else the default value will be <code>true</code>. |
||
| 141 | </p> |
||
| 142 | </td></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_forwardSlashIsSeparator"><td><code class="attributeName">forwardSlashIsSeparator</code></td><td> |
||
| 143 | <p>If this is <code>true</code> Tomcat will treat the forward slash |
||
| 144 | character ('<code>/</code>') as an HTTP separator when processing cookie |
||
| 145 | headers. If <code>org.apache.catalina.STRICT_SERVLET_COMPLIANCE</code> |
||
| 146 | is set to <code>true</code>, the default of this setting will be |
||
| 147 | <code>true</code>, else the default value will be <code>false</code>. |
||
| 148 | </p> |
||
| 149 | </td></tr><tr id="Attributes_Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor_sameSiteCookies"><td><code class="attributeName">sameSiteCookies</code></td><td> |
||
| 150 | <p>Enables setting same-site cookie attribute.</p> |
||
| 151 | |||
| 152 | <p>If value is <code>unset</code> then the same-site cookie attribute |
||
| 153 | won't be set. This is the default value.</p> |
||
| 154 | |||
| 155 | <p>If value is <code>none</code> then the same-site cookie attribute |
||
| 156 | will be set and the cookie will always be sent in cross-site requests.</p> |
||
| 157 | |||
| 158 | <p>If value is <code>lax</code> then the browser only sends the cookie |
||
| 159 | in same-site requests and cross-site top level GET requests.</p> |
||
| 160 | |||
| 161 | <p>If value is <code>strict</code> then the browser prevents sending the |
||
| 162 | cookie in any cross-site request.</p> |
||
| 163 | </td></tr></table> |
||
| 164 | |||
| 165 | </div></div> |
||
| 166 | |||
| 167 | </div><h3 id="Nested_Components">Nested Components</h3><div class="text"> |
||
| 168 | |||
| 169 | <p>No element may be nested inside a <strong>CookieProcessor</strong>.</p> |
||
| 170 | |||
| 171 | </div><h3 id="Special_Features">Special Features</h3><div class="text"> |
||
| 172 | |||
| 173 | <p>No special features are associated with a <strong>CookieProcessor</strong> |
||
| 174 | element.</p> |
||
| 175 | |||
| 176 | </div></div></div></div></div><footer><div id="footer"> |
||
| 177 | Copyright © 1999-2025, The Apache Software Foundation |
||
| 178 | <br> |
||
| 179 | Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo |
||
| 180 | are either registered trademarks or trademarks of the Apache Software |
||
| 181 | Foundation. |
||
| 182 | </div></footer></div></body></html> |