Send Cookies

How it works

Going from client to server, cookies do not each get a header. A browser combines all of them into one Cookie request header, with name=value pairs separated by a semicolon and a space. REST Assured follows the same rule. Each cookie(name, value) call on the request specification adds one pair, and when you call it twice the server receives a single header holding both; echoing the request headers through testkru showed exactly session_id=abc123; theme=dark. To add many at once, cookies() accepts a Map of names to values.

The /cookies/read endpoint reports what arrived, wrapped in a cookies object keyed by cookie name. So the values sit one level down, at paths such as cookies.theme, and jsonPath().getString() reads them.

Two quirks of this PHP server are worth knowing. With no cookies at all it returns cookies as an empty JSON array rather than an empty object, so reading cookies.session_id gives the two-character string of empty brackets instead of null. And if you send the same cookie name twice, it keeps the first value. Both are server behaviours, not REST Assured ones, which is why tests should assert on what the server echoes rather than on assumptions.

About the assignment

Send two cookies on a GET request and print the values the server says it received.

What you will do

1. 1Start from given() and call cookie() once for session_id and once for theme, with the values in the starter comment.
2. 2Send the request with get() on /cookies/read, keeping the Response.
3. 3Read both echoed values from inside the cookies object with jsonPath().getString().
4. 4Print one line per cookie, the cookie name and a colon followed by its echoed value.

Common mistakes

• Reading at the top level

  The body has a single key, cookies. A path of plain session_id misses the wrapper and comes back null.

• Confusing the two cookie() methods

  On given(), cookie() adds a cookie to the outgoing request. On a Response it reads a cookie the server set, and after then() it asserts one. Same name, three different jobs.

• Trusting the empty case

  If the cookies never reach the server, the echoed path does not return null here; it returns the empty-array text. A check for null alone would let that slip through, so compare against the expected value.

In a real test suite

Related lessons

• Receive CookiesReads the cookies a server sets from the Set-Cookie response headers.
• Cookie Round-TripCombines reading and sending into one round trip between two endpoints.
• Echo Request HeadersSends custom request headers and reads them back from the echo endpoint.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: GET /cookies/read with cookies:
        //   session_id = "abc123"
        //   theme = "dark"
        // TODO: Extract cookies.session_id and cookies.theme from response body
    }
}