Cookie Round-Trip

How it works

A browser stores the cookies a site sets and attaches them to every later request automatically. REST Assured does not. Each given() starts a fresh request with no memory of earlier responses, so a call to /cookies/read made right after /cookies/set arrives with no cookies at all. If a later call needs a cookie, your test has to carry it across.

There are two direct ways to do that. Read each value with getCookie() on the first response and pass it into cookie() on the second request. Or hand over the whole set in one move: getCookies() returns a Map, and cookies() on the next request accepts that map, which sends both values. Only name and value travel back. Attributes such as Path, SameSite and Secure tell a client how to store a cookie; they are never part of the Cookie request header.

This handoff is the core of session testing. The first response is a login or setup step; the second proves the server recognises the session it created.

About the assignment

Collect the two cookies from the setting endpoint, send them to the reading endpoint, and print the values it echoes back.

What you will do

1. 1Send a GET for /cookies/set, keep that response, and extract session_id and theme into two String variables with getCookie().
2. 2Build a new request with given(), adding both extracted values through cookie(), and send a GET for /cookies/read.
3. 3From this second response, read the two values nested under cookies with jsonPath().getString().
4. 4Print them on two lines, each starting with Round-trip followed by the cookie name and a colon.

Common mistakes

• Expecting cookies to carry over

  Calling the read endpoint without attaching anything returns an empty cookies value. REST Assured has no automatic cookie jar between separate requests.

• Hard-coding the values

  Typing the literal strings into the second request produces the same output, but it no longer tests anything about the first response. Pass the variables you extracted so a change on the server shows up.

• Reading cookies from the wrong response

  /cookies/read sets no cookies of its own. Calling getCookie() on its response returns null; the values you want come from its JSON body instead.

In a real test suite

Related lessons

• Receive CookiesCovers reading cookie values from a response in detail.
• Send CookiesCovers attaching cookies to a request and what the server echoes.
• Bearer Token AuthenticationUses the same two-step pattern with a JWT in a header instead of a cookie.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // Step 1: GET /cookies/set and extract the cookie values
        // TODO: Extract session_id and theme cookies

        // Step 2: GET /cookies/read, sending the extracted cookies
        // TODO: Verify cookies are echoed back
    }
}