Question

I was wondering if it’s possible to write cookies to clients from unsigned applets.

Answer 1

Yes they can, you can use JSObject for this.
Small note here, you need to add the plugin.jar from the jre/lib directory to your path in order to get this compiled.

Reading:

import netscape.javascript.JSObject;

String data = "";
String cookiename = "fooCookie";
JSObject myBrowser = JSObject.getWindow(this);
JSObject myDocument = (JSObject) myBrowser.getMember("document");

String myCookie = (String) myDocument.getMember("cookie");
if (myCookie.length() > 0) {
    String[] cookies = myCookie.split(";");
    for (String cookie : cookies) {
        int pos = cookie.indexOf("=");
        if (cookie.substring(0, pos).trim().equals(cookiename)) {
            data = cookie.substring(pos + 1);
            break;
        }
    }
}

Writing:

String data = "test";
String cookiename = "fooCookie";
JSObject win = JSObject.getWindow(this);
JSObject doc = (JSObject) win.getMember("document");
String data = cookiename + "=" + data + "; path=/; expires=Thu, 31-Dec-2019 12:00:00 GMT";
doc.setMember("cookie", data);

Don’t forget to encode your data in Base64.