I have a Java application that sets a cookie:
Cookie keks = new Cookie("Demo","WeLoveCookies"); keks.setHttpOnly(true); keks.setSecure(true); keks.setPath("/"); response.addCookie(keks);
when opening the URL that does that, it gets set in the browser (Set-Cookie header) and send with all future requests (e.g. following a link on the same host).
When embedding that URL as a canvas application, the Set-Cookie header is still present (Header:
Set-Cookie: Demo=WeLoveCookies; Path=/; Secure; HttpOnly), however the cookie doesn't get stored (don't see it in the Chrome developer tools) and hence not send back with any further request.
What do I miss?