How do Tomcat's Cookies work?

Question

I am confused about a couple things regarding cookies.

1. Why do I need to use/customize javax.servlet.http.Cookie class in order to implement a Remember me feature?

   In my web.xml couldn't I just use?:

    <session-config> <session-timeout>10080</session-timeout> </session-config> 

2. Isn't it a security issue having cookies on a computer? Couldn't a cracker steal another user's cookie and hijack their session?

Answer 1

1. You don't - you just need to create an http session . Tomcat will either create a cookie or use a jsessionid URL parameter to maintain your session - this is part of the Java EE servlet specification . If you use a JSP then they automatically create http sessions . Various other things can cause sessions to be created also.

2. Yes, this is called session hijacking .