The following is the Model object shared between two controllers and works well using Chrome and Mozilla browsers:


// @params
/* 'cookieCheck',
   false */
public static void createCookie(string cookieName,string cookieValue,integer maxAgeInSeconds,boolean isHttpsOnly){
    ApexPages.currentPage().setCookies(new Cookie[]{new Cookie(

public static void createNewCookie(String user,String cookieName){
    // create cookie

public static Cookie getCookie(string cookieName){
    system.debug('&&&&&&&&    Portal.getCookie('+cookieName+')    &&&&&&&&');

    Cookie thisCookie=ApexPages.currentPage().getCookies().get(cookieName);
    system.debug('&&&..... thisCookie = '+string.valueOf(thisCookie)); // coming null for IE while Chrome and Mozilla returns System.Cookie[cookieCheck=test,123;path=/;expires=-1;isSecure=true]

    return thisCookie;
}//END getCookie()

For the first controller the invocation is like: PortalCheck.createNewCookie('test','cookieCheck'); and then redirected to a new page which again invokes the getCookie() method with the same cookieName as PortalCheck.getCookie('cookieCheck'); from the second controller.

So, the above Model class is shared among two controllers - The first controller is setting the cookies into it and second one is fetching cookies out of it. It works well for Chrome and Mozilla browsers but it always gives the null result during getCookie(); method invocation for MS Internet Explorer.

Please let me know what I'm doing wrong or let me know if anything can be fixed using the above approach. Its working fine if we simply let the Controllers do the setCookies and getCookie using IE.

EDIT Please refer to the link to repository.

PS: I have checked for almost each version of IE: 7, 8, 9 and 11. Also, checked all the options under Privacy-->advanced and also, added the sites as: Privacy-->sites and putting all the possible links available for the org as well as vf pages.

  • Are these pages displayed in an (i)frame?
    – FrankZ
    Nov 29 '13 at 10:47
  • If you simply go through the repository its regarding the Cookies accessibility via Apex class. I'm trying to simply maintain the cookies from Login page and access over the Home page via Apex class. So, if you include an Apex class between the controllers to maintain the cookies it doesn't work in IE Browser which is the problem I'm facing.
    – sanchit
    Nov 29 '13 at 14:09
  • Yes, understood that @sanchit. The reason I was asking if your pages are displayed in an iFrame is that IE handles cookies in iFrames differently than in the main page. So it would be helpful if you could answer my question.
    – FrankZ
    Nov 29 '13 at 14:50
  • I do know about that the pages are displayed in iFrame but not sure if the cookies are stored in them or not. So you are trying to say that iFrames are responsible for such behavior? If so, could you demonstrate some example?
    – sanchit
    Nov 29 '13 at 17:40
  • 1
    I think you can find tons of examples if you search for "p3p iframe internet explorer" or such in the search engine of your choice. Or look here on stackexchange, e.g. stackoverflow.com/questions/389456/…
    – FrankZ
    Nov 30 '13 at 0:20

I am pretty sure it works if you change the '.force.' to null in your Cookie creation. Just booted Windows, installed a gazillion updates, and then tested it in IE10.

That parameter is the path of the cookie, not the domain. Unfortunately the constructor of the Cookie class seems not to be documented, the best 'documentation' I found from Salesforce is in the example code of the documentation.

What's interesting is that Chrome and Firefox seem to ignore the path value '.force.' as it doesn't look like a proper path (maybe they only take it into account if it starts with a slash) while IE does not store the cookie as it doesn't match the path. Looking at RFC 6265 it seems that IE gets it wrong (Who would've thought ...):

If the uri-path is empty or if the first character of the uri-path is not a %x2F ("/") character, output %x2F ("/") and skip the remaining steps.

  • it works well now. But I'm not getting how did it solve the problem if I simply change the domain to null. If the parameter is the path to Cookie then what should be preferably given. Could you provide more explanation above.
    – sanchit
    Dec 1 '13 at 4:13
  • @sanchit I've extended my answer, hope it helps. Mind you, you did not set the domain to null, but the path.
    – FrankZ
    Dec 1 '13 at 17:23
  • I appreciate the reason that further steps in IE would have been skipped. But could you mind telling me why does it work simply if the setCookies is simply placed in Controller1 (Controller) instead of PortalCheck (Model) if the path is even set to '.force.' for IE?
    – sanchit
    Dec 2 '13 at 5:32
  • I can't reproduce that, @sanchit. Just tried it with IE8 on Windows XP and it won't retrieve the cookie set directly by Controller1. Controller2 gets a null value for cookie 'cookieCheck' - which I had set directly in Controller1 using the path parameter '.force.' - As expected the same works fine in Chromium on Ubuntu Linux though.
    – FrankZ
    Dec 2 '13 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.