When making an HTTP callout using HttpRequest, Set-Cookie headers returned with the HttpOnly flag are not included in the HttpResponse. This appears to be consistent with RFC 6265:
The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).
Is there a way to make use of cookies set with the HttpOnly flag in subsequent HttpRequest objects? Support for an opaque cookie jar would be useful so that each time an HttpRequest is sent using Http.send, the cookies in the jar are sent, and the cookie jar is updated when Set-Cookie headers are included in the response. Something like:
CookieJar jar = new CookieJar();
Http callout = new Http();
callout.setCookieJar(jar);
This problem has recently broken our integration between Salesforce and GoodData. I don't know if HttpOnly support was added in Winter '14 or if GoodData just started setting the HttpOnly flag.
Here's some sample code to demonstrate the problem.
Any ideas on how to address this problem?
