Program Statement

Assume four users user1, user2, user3 and user4 having the passwords pwd1, pwd2, pwd3 and pwd4 respectively. Write a servlet to: (1) create a Cookie and add these four user IDs and passwords to it, and (2) read the user ID and password entered in the login form and authenticate against the values available in the cookie.

The Real Servlet Code (deploy on Tomcat)

// SetCookieServlet.java — runs once to create the auth cookie
@WebServlet("/set-cookie")
public class SetCookieServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String data = "user1:pwd1,user2:pwd2,user3:pwd3,user4:pwd4";
        Cookie authCookie = new Cookie("authData", data);
        authCookie.setMaxAge(60 * 60); // 1 hour
        resp.addCookie(authCookie);
        resp.getWriter().println("Auth cookie created!");
    }
}

// LoginServlet.java — reads the login form and checks it against the cookie
@WebServlet("/login")
public class LoginServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String uid = req.getParameter("uid");
        String pwd = req.getParameter("pwd");
        boolean authenticated = false;

        Cookie[] cookies = req.getCookies();
        if (cookies != null) {
            for (Cookie c : cookies) {
                if ("authData".equals(c.getName())) {
                    for (String pair : c.getValue().split(",")) {
                        String[] parts = pair.split(":");
                        if (parts[0].equals(uid) && parts[1].equals(pwd)) {
                            authenticated = true;
                        }
                    }
                }
            }
        }
        resp.getWriter().println(authenticated ? "Login successful!" : "Invalid credentials.");
    }
}

Browser Simulation

document.cookie is the browser's equivalent of the Servlet Cookie API. The demo below stores the four user/password pairs in a cookie on page load, then a login form reads and checks document.cookie — exactly mirroring the servlet logic above, fully client-side.

CO Mapping

CO5