When making an HTTP callout using
Set-Cookie headers returned with the
HttpOnly flag are not included in the
HttpResponse. This appears to be consistent with RFC 6265:
The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).
HttpOnly flag in subsequent
HttpRequest objects? Support for an opaque cookie jar would be useful so that each time an
HttpRequest is sent using
Http.send, the cookies in the jar are sent, and the cookie jar is updated when
Set-Cookie headers are included in the response. Something like:
CookieJar jar = new CookieJar(); Http callout = new Http(); callout.setCookieJar(jar);
This problem has recently broken our integration between Salesforce and GoodData. I don't know if
HttpOnly support was added in Winter '14 or if GoodData just started setting the
Here's some sample code to demonstrate the problem.
Any ideas on how to address this problem?