使用Servlet Filter通过ThreadLocal重写Cookie不生效的问题排查与解决

我正在使用Servlet Filter拦截携带Cookie的请求，尝试通过ThreadLocal重写指定Cookie的值，但重写后的值未生效，新增Cookie的操作也执行失败，无法定位具体原因。
项目中涉及三类核心代码：

• Controller类：包含两个GET端点，/cookie端点用于在响应中添加测试Cookie，方便后续访问/override端点时拦截测试Cookie重写逻辑
• Filter类：负责拦截请求、校验指定Cookie并完成Cookie重写
• 存储Cookie值的POJO类

核心代码片段 #

Controller实现 #

@RestController
public class FilterController {
    
    @Autowired
    AlphaCookie alphaCookie;
    
    @Autowired
    AlphaCookieFilter alphaCookieFilter;
    
    @GetMapping("override") // 重写Cookie的测试端点
    public String cookieTest() {
        this.alphaCookieFilter.persist(new AlphaCookie("newValue"));
        return "Cookie Overriden, { AlphaCookie: newValue }";
    }
    
        
    @GetMapping("cookie")   // 用于添加测试Cookie
    public String addCookieToBrowser(HttpServletResponse httpServletResponse) {
        Cookie cookie = new Cookie("AlphaCookie", "oldValue");
        cookie.setMaxAge(3600);
        httpServletResponse.addCookie(cookie);
        return "Cookie added, { AlphaCookie: old }";
    }
}

Filter实现 #

@Component("alphaCookieFilter")
public class AlphaCookieFilter implements Filter {

    @Autowired
    private ApplicationContext applicationContext;
    
    public static final ThreadLocal<HttpServletResponse> RESPONSE_HOLDER  = new ThreadLocal<>();
    

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        RESPONSE_HOLDER.set((HttpServletResponse) response);
        
        String activeCookie = null;
        
        if (httpServletRequest.getCookies() != null) {
            for (Cookie cookie: httpServletRequest.getCookies()) {
                if ("AlphaCookie".equals(cookie.getName())) {
                    activeCookie = cookie.getValue();
                }
            }
        }
        
        this.applicationContext.getBean("alphaCookie", AlphaCookie.class)
                               .override(new AlphaCookie(activeCookie));
        
        chain.doFilter(request, response);
        RESPONSE_HOLDER.remove();
    }
    
    public void persist(AlphaCookie alphaCookie) {
        Cookie cookie = new Cookie("AlphaCookie", alphaCookie.getActiveCookie());
        cookie.setDomain("code.org");
        cookie.setPath("/");
        cookie.setMaxAge(-1);
        cookie.setSecure(true);
        cookie.setHttpOnly(true);
        RESPONSE_HOLDER.get().addCookie(cookie);
    }
}

存储Cookie值的POJO实现 #

@Component("alphaCookie")
public class AlphaCookie implements Serializable {

    private static final long serialVersionUID = 1L;

    private String activeCookie;

    public AlphaCookie() {
        super();
    }

    public AlphaCookie(String activeCookie) {
        this();
        this.activeCookie = activeCookie;
    }


    public void override(AlphaCookie alphaCookie) {
        synchronized (this) {
            this.activeCookie = alphaCookie.activeCookie;
        }
    }

    public String getActiveCookie() {
        return this.activeCookie;
    }
}

问题排查结果 #

经过调试确认，以下两个Cookie配置项是导致Cookie重写失效、新增Cookie失败的直接原因：

cookie.setDomain("code.org");
cookie.setSecure(true);

解决方案 #

本地环境测试时需要调整Cookie配置，满足以下要求：

• 将Cookie的domain设置为localhost，避免跨域限制导致Cookie被浏览器丢弃
• 由于本地localhost默认使用HTTP协议、未开启HTTPS，需将cookie.setSecure设置为false，否则标记了secure属性的Cookie只会在HTTPS请求下被浏览器保存

内容的提问来源于stack exchange，提问作者Dan