Skip to content
CodeKruPro

Receive Cookies

51/62

Receive Cookies

The /cookies/set endpoint sets cookies in the response. Use response.getCookie() to read them:

String value = response.getCookie("cookieName");  // null if the cookie was not set

This endpoint sets two cookies: session_id=abc123 and theme=dark.

Task: Fetch the cookies and print their values.

Expected output:

Message: Cookies have been set
session_id: abc123
theme: dark

About this lesson

REST Assured: get a cookie from the response with getCookie()

Learn REST AssuredAdvancedCookies

How it works

Servers hand cookies to clients through Set-Cookie response headers, one header per cookie. The testkru /cookies/set endpoint sends two of them, session_id and theme, each carrying the attributes path=/, SameSite=Lax and Secure. Its JSON body is separate: a message string and a set array naming the two cookies. The values themselves are not in the body at all; they live only in the headers.

REST Assured parses those headers for you. getCookie(name) on the Response, or its shorter alias cookie(name), returns the value as a String, and it returns null when no cookie of that name arrived. getCookies() gives every cookie at once as a Map from name to value. Neither method exposes the attributes. For those, getDetailedCookie(name) returns a Cookie object: on this endpoint getPath() answers "/", isSecured() answers true and isHttpOnly() answers false.

Cookies can be asserted as well as read. On the then() side, cookie() with a name and an expected value, or a name and a Hamcrest matcher such as equalTo(), fails the test when the cookie is missing or different.

About the assignment

Call the cookie-setting endpoint, print the confirmation message from the JSON body, then print the value of each cookie the server set.

What you will do

  1. Send a GET for /cookies/set and keep the Response.
  2. Read message from the body with jsonPath().getString() and print it after the Message: label.
  3. Read the session_id value with getCookie() and print it after a label that repeats the cookie name and a colon.
  4. Do the same for theme, so the output ends with one line per cookie.

Common mistakes

  • Looking for cookie values in the body

    The body only lists cookie names. A JsonPath read for session_id returns null, because the value travels in a header, not in the JSON.

  • A misspelt name fails silently

    getCookie() does not throw for an unknown name; it returns null, and your output prints the word null. If the cookie must exist, assert it through then().cookie() so the failure is explicit.

  • Parsing Set-Cookie by hand

    The raw header values are available through getHeaders().getValues("Set-Cookie"), but splitting them on semicolons is fragile. getCookie() and getDetailedCookie() already do that parsing correctly.

In a real test suite

Login endpoints that start a browser-style session set a session cookie exactly like this, and security reviews often ask for tests on the flags. A JUnit 5 test can fetch the detailed cookie and assert that isSecured() is true and, for session tokens, that isHttpOnly() is true too, since a script-readable session cookie is an easy target for cross-site scripting.

Related lessons

  • Send CookiesGoes the other way and sends cookies to the server with cookie() on the request.
  • Cookie Round-TripFeeds the cookies read here into a second request.
  • Custom Response HeadersReads other response headers with getHeader(), the general form of this lesson.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

Main.java
import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: GET /cookies/set
        // TODO: Print the message from the response body
        // TODO: Extract and print "session_id" and "theme" cookies
    }
}
Next lessonSend CookiesAll lessons in the courseLearn REST Assured