We have an intranet Sites application (no Site Login used). Recently, I was extending the application to use cookies across page redirects rather than URL parameters for shared information.

To start, I created a secure Cookie in a page action method:

PageReference somePage1Action() {
   ApexPages.currentPage().setCookies(new List<Cookie> {
        new Cookie('secureCookie','{"cookieSet" : true}',null,7200,true)
   PageReference resPg = Page.somePage2;
   return resPg;

when Page2 was displayed as a redirect, there was no Cookie named secureCookie. The controller code:


returned null (!?!).

1 Answer 1


I wrote a small test program that yielded the answer:

public with sharing class CookieController {

    private static PageReference COOKIEPAGE1 = Page.CookiePage1;
    private static PageReference COOKIEPAGE2 = Page.CookiePage2;

    public String getSecureCookieValue() {
      return ApexPages.currentPage().getCookies().get('secureCookie') != null 
        ? ApexPages.currentPage().getCookies().get('secureCookie').getValue() 
        : 'no secure cookie found';}
    public String getInsecureCookieValue() {
      return ApexPages.currentPage().getCookies().get('insecureCookie') != null 
        ? ApexPages.currentPage().getCookies().get('inSecureCookie').getValue() 
        : 'no insecure cookie found';}

    //  ---constructor---
    public CookieController() {
        if (apexPages.currentPage().getURL().contains('CookiePage1')) { // delete any extant cookies
            ApexPages.currentPage().setCookies(new List<Cookie> {   new Cookie('secureCookie','{"cookieSet" : true}',null,0,true),
                                                                    new Cookie('insecureCookie','{"cookieSet" : true}',null,0,false)});

    public PageReference cookiePage1Action() {
        ApexPages.currentPage().setCookies(new List<Cookie> {   new Cookie('secureCookie','{"cookieSet" : true}',null,7200,true),
                                                                new Cookie('insecureCookie','{"cookieSet" : true}',null,7200,false)}
        return COOKIEPAGE2;

    public PageReference cookiePage2Action() {
        return null;

VF landing page

<apex:page controller="CookieController" cache="false" action="{!cookiePage1Action}">
<h1>Cookie page 1</h1>

Landing page redirects to this page (that displays cookie value)

<apex:page controller="CookieController" cache="false" action="{!cookiePage2Action}">
<h1>Cookie page 2</h1>
    <p>Secure Cookie Value: <apex:outputText value="{!securecookieValue}"/></p>   

    <p>Insecure Cookie Value: <apex:outputText value="{!insecurecookieValue}"/></p> 

when this page displayed, I got this:

enter image description here

and by this time, the answer was staring me in the face. When the site had been setup back in 2009, the Require Secure Connections check box was unchecked: enter image description here

Checking the box and repeating the test yielded expected results:

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .