This is more reference information than a good answer to your question, but this is how some code I work on uses a cookie...
The code that sets the cookie is in a HTTP callback and so has a PageReference
available:
PageReference pr = ApexPages.currentPage();
pr.setCookies(new Cookie[] {
new Cookie(
SESSION_KEY_NAME, // name
sessionId, // value
null, // path
-1, // max age (session cookie)
true // https only
)
});
and then later @RestResource
classes access the cookie like this:
RestRequest req = RestContext.request;
String sessionId = req.headers.get(Session.SESSION_KEY_NAME);
(The cookie name gets prefixed with "apex__" by the time it gets to the browser but this is hidden internally.)
PS
Accessing the cookie via the header is only possible because my (AngularJs) client puts it there:
var cvEepSid = $cookies['apex__Cv-Eep-Sid'];
$http.defaults.headers.common = {'Cv-Eep-Sid': cvEepSid};
I'd forgotten about this...