CookieManager (Java SE 25 & JDK 25)
Description: declaration: module: java.base, package: java.net, class: CookieManager
Keywords: java.net.CookieManager class

# Class CookieManager

java.lang.Object
java.net.CookieHandler
java.net.CookieManager

public class CookieManager extends CookieHandler
CookieManager provides a concrete implementation of `CookieHandler`, which separates the storage of cookies from the policy surrounding accepting and rejecting cookies. A CookieManager is initialized with a `CookieStore` which manages storage, and a `CookiePolicy` object, which makes policy decisions on cookie acceptance/rejection.

The HTTP cookie management in java.net package looks like:

>                      use
>     CookieHandler <------- HttpURLConnection
>           ^
>           | impl
>           |         use
>     CookieManager -------> CookiePolicy
>                 |   use
>                 |--------> HttpCookie
>                 |              ^
>                 |              | use
>                 |   use        |
>                 |--------> CookieStore
>                                ^
>                                | impl
>                                |
>                      Internal in-memory implementation

> - CookieHandler is at the core of cookie management. User can call CookieHandler.setDefault to set a concrete CookieHandler implementation to be used.
> - CookiePolicy.shouldAccept will be called by CookieManager.put to see whether or not one cookie should be accepted and put into cookie store. User can use any of three pre-defined CookiePolicy, namely ACCEPT_ALL, ACCEPT_NONE and ACCEPT_ORIGINAL_SERVER, or user can define his own CookiePolicy implementation and tell CookieManager to use it.
> - CookieStore is the place where any accepted HTTP cookie is stored in. If not specified when created, a CookieManager instance will use an internal in-memory implementation. Or user can implements one and tell CookieManager to use it.
> - Currently, only CookieStore.add(URI, HttpCookie) and CookieStore.get(URI) are used by CookieManager. Others are for completeness and might be needed by a more sophisticated CookieStore implementation, e.g. a NetscapeCookieStore.

There're various ways user can hook up his own HTTP cookie management behavior, e.g.

> - Use CookieHandler.setDefault to set a brand new `CookieHandler` implementation
> - Let CookieManager be the default `CookieHandler` implementation, but implement user's own `CookieStore` and `CookiePolicy` and tell default CookieManager to use them:

>   >           // this should be done at the beginning of an HTTP session
>   >           CookieHandler.setDefault(new CookieManager(new MyCookieStore(), new MyCookiePolicy()));

> - Let CookieManager be the default `CookieHandler` implementation, but use customized `CookiePolicy`:

>   >           // this should be done at the beginning of an HTTP session
>   >           CookieHandler.setDefault(new CookieManager());
>   >           // this can be done at any point of an HTTP session
>   >           ((CookieManager)CookieHandler.getDefault()).setCookiePolicy(new MyCookiePolicy());

The implementation conforms to RFC 2965, section 3.3.

Since:
  1.6
External Specifications
  - RFC 2965: HTTP State Management Mechanism
See Also:
  - `CookiePolicy`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `CookieManager()`
  Create a new cookie manager.
  `CookieManager(CookieStore store, CookiePolicy cookiePolicy)`
  Create a new cookie manager with specified cookie store and cookie policy.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `Map<String, List<String>>`
  `get(URI uri, Map<String, List<String>> requestHeaders)`
  Gets all the applicable cookies from a cookie cache for the specified uri in the request header.
  `CookieStore`
  `getCookieStore()`
  To retrieve current cookie store.
  `void`
  `put(URI uri, Map<String, List<String>> responseHeaders)`
  Sets all the applicable cookies, examples are response header fields that are named Set-Cookie2, present in the response headers into a cookie cache.
  `void`
  `setCookiePolicy(CookiePolicy cookiePolicy)`
  To set the cookie policy of this cookie manager.

  ### Methods declared in class CookieHandler

  `getDefault, setDefault`

  ### Methods declared in class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Constructor Details

  - ### CookieManager

    public CookieManager()
    Create a new cookie manager.

    This constructor will create new cookie manager with default cookie store and accept policy. The effect is same as `CookieManager(null, null)`.

  - ### CookieManager

    public CookieManager(CookieStore store, CookiePolicy cookiePolicy)
    Create a new cookie manager with specified cookie store and cookie policy.
    Parameters:
      `store` - a `CookieStore` to be used by cookie manager. if `null`, cookie manager will use a default one, which is an in-memory CookieStore implementation.
      `cookiePolicy` - a `CookiePolicy` instance to be used by cookie manager as policy callback. if `null`, ACCEPT_ORIGINAL_SERVER will be used.

- ## Method Details

  - ### setCookiePolicy

    public void setCookiePolicy(CookiePolicy cookiePolicy)
    To set the cookie policy of this cookie manager.

    An instance of `CookieManager` will have cookie policy ACCEPT_ORIGINAL_SERVER by default. Users always can call this method to set another cookie policy.

    Parameters:
      `cookiePolicy` - the cookie policy. Can be `null`, which has no effects on current cookie policy.

  - ### getCookieStore

    public CookieStore getCookieStore()
    To retrieve current cookie store.
    Returns:
      the cookie store currently used by cookie manager.

  - ### get

    public Map<String, List<String>> get(URI uri, Map<String, List<String>> requestHeaders) throws IOException
    Description copied from class: `CookieHandler`
    Gets all the applicable cookies from a cookie cache for the specified uri in the request header.

    The `URI` passed as an argument specifies the intended use for the cookies. In particular the scheme should reflect whether the cookies will be sent over http, https or used in another context like javascript. The host part should reflect either the destination of the cookies or their origin in the case of javascript.

    It is up to the implementation to take into account the `URI` and the cookies attributes and security settings to determine which ones should be returned.

    HTTP protocol implementers should make sure that this method is called after all request headers related to choosing cookies are added, and before the request is sent.

    Specified by:
      `get` in class `CookieHandler`
    Parameters:
      `uri` - a `URI` representing the intended use for the cookies
      `requestHeaders` - a Map from request header field names to lists of field values representing the current request headers
    Returns:
      an immutable map from state management headers, with field names "Cookie" or "Cookie2" to a list of cookies containing state information
    Throws:
      `IOException` - if an I/O error occurs
    See Also:
      - `CookieHandler.put(URI, Map)`

  - ### put

    public void put(URI uri, Map<String, List<String>> responseHeaders) throws IOException
    Description copied from class: `CookieHandler`
    Sets all the applicable cookies, examples are response header fields that are named Set-Cookie2, present in the response headers into a cookie cache.
    Specified by:
      `put` in class `CookieHandler`
    Parameters:
      `uri` - a `URI` where the cookies come from
      `responseHeaders` - an immutable map from field names to lists of field values representing the response header fields returned
    Throws:
      `IOException` - if an I/O error occurs
    See Also:
      - `CookieHandler.get(URI, Map)`