Using the play framework the cookie called TEST is not set on the initial page load. Instead I see the set-cookie header used only for the cookie called PLAY_SESSION. When I reload the same page, the cookie called TEST does get set this time. If the initial Play session is not found, does it not set any cookies until it's set itself?
@AddCSRFToken
public Promise<Result> post(String version) {
final LaunchRequest launchRequest = new LaunchRequest(request().body().asFormUrlEncoded(), false);
Promise<ConsumerInstance> promiseOfConsumerInstance = null;
try {
promiseOfConsumerInstance = consumerInstanceDAO.getByConsumerKey(new ConsumerKey(launchRequest.getOauth_consumer_key()));
} catch (DataAccessException e) {
Logger.warn(e.getMessage());
}
if (promiseOfConsumerInstance != null) {
Map<String, String> paramMap = launchRequest.toSortedMap();
try {
response().setCookie(
"TEST, CookieUtils.serializeParameters(paramMap), null, "/lti/debug");
} catch (Exception e) {
Logger.warn(e.getMessage(), e);
}
return promiseOfConsumerInstance.map(new ConsumerInstanceFunction(launchRequest)).recover(new RecoverFunction(launchRequest));
}
else {
return null;
}
}
Removing the
@AddCSRFToken
logic fixed the issue. I can only think that the response couldnt be modified somehow in this method, causing me not to be able to do anything with the response. I couldnt even set a little header. This page was already protected so removing this wasnt an issue but there still seems to be an issue on how this works with Play, and this is only a work around.