I'm trying to read some cookies set by previous requests in an Apex REST handler. I can see the cookie is sent to the page by my browser (using the Cookie HTTP header), but if within the Apex code I enumerate the headers I see many of those, but no Cookie.

Is that at all possible?

1 Answer 1


This is more reference information than a good answer to your question, but this is how some code I work on uses a cookie...

The code that sets the cookie is in a HTTP callback and so has a PageReference available:

PageReference pr = ApexPages.currentPage();
pr.setCookies(new Cookie[] {
        new Cookie(
                SESSION_KEY_NAME,           // name
                sessionId,                  // value
                null,                       // path
                -1,                         // max age (session cookie)
                true                        // https only

and then later @RestResource classes access the cookie like this:

RestRequest req = RestContext.request;
String sessionId = req.headers.get(Session.SESSION_KEY_NAME);

(The cookie name gets prefixed with "apex__" by the time it gets to the browser but this is hidden internally.)


Accessing the cookie via the header is only possible because my (AngularJs) client puts it there:

var cvEepSid = $cookies['apex__Cv-Eep-Sid'];
$http.defaults.headers.common = {'Cv-Eep-Sid': cvEepSid};

I'd forgotten about this...

  • Hmm this seems strange to me... The 'headers' collection contains the http headers, but seeing your code it would contain the cookies by names as well? I've tried it on my side and I can't get it to work. I see a cookie in my browser named apex__FOO, but if I call req.headers.get('FOO') in my @RestResource it returns null.
    – Martin
    Commented Jun 25, 2014 at 19:58
  • @Martin Perhaps it is a domain problem? In my case both the pages and REST API are being served through a common (Force.com Site) domain. (Should have mentioned that.)
    – Keith C
    Commented Jun 25, 2014 at 20:14
  • The domain is the same, and I see the cookie being sent by the browser with the http request (in the Cookie HTTP header). Also, I've noticed that older versions of the RestRequest class (v22 for example, see here: salesforce.com/us/developer/docs/apex_rest220/Content/…) have a 'cookies' property, but this seems to have disappeared in later versions. Can't access it either by switching to v22 for my class, alas. Anyway, I'll keep on digging.
    – Martin
    Commented Jun 25, 2014 at 20:18
  • @Martin Your comment made me look again at my code. I'd forgotten that I'm adding the cookie to the header at the client-side; I've updated the answer. So I must have gone through the same pain you are experiencing...
    – Keith C
    Commented Jun 25, 2014 at 20:29
  • Well. I'm pretty sad I was right. I'll probably end up doing something similar, using a query string argument since this must work for cross domain requests on IE8 as well.
    – Martin
    Commented Jun 25, 2014 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .