Question

Why aren’t cookies able to be referenced from a servlet filter? It just seems beyond me that Java EE wouldn’t allow you to sanitize cookie values:

public void doFilter(ServletRequest request, ServletResponse response, 
                             FilterChain chain) 
                             throws ServletException, IOException {
    request.
}

ServletRequest does not support getCookies (as is the case with HttpServletRequest).

Answer 1

In order to get the cookies you need to cast it to an HttpServletRequest.

HttpServletRequest httpReq = (HttpServletRequest) request;

The reason that ServletResponse class doesn’t support cookies is because the protocol isn’t necessarly http in a ServletRequest, you can’t be sure there are Cookies. Cookies are an Http thing.