title: Old new "delete/invalidade" Cookie on an application
body: <p>Hy Guys.</p>
  
  <p>I've read many questions here on SO about invalidating a cookie on a request and adding it to a response (I know that it can't be physical deleted). </p>
  
  <p>I've read this <a href="https://stackoverflow.com/questions/890935/how-do-you-remove-a-cookie-in-a-java-servlet">How do you remove...Cookie</a> which is the closest to my problem. And none of the answers and suggestions helped me on my particular case (I think).</p>
  
  <p>I'm testing it on my machine so, my domain is my work domain. I have an eclipse with a tomcat server configured and another eclipse with a JBoss server configured.</p>
  
  <p>So, my case here is that I've made a <strong>Single Sign On</strong> system where I have a domain which is the single login system (say: <code>myMachine.myCompany.com:8081/login</code> lets name it <em>login</em>) and I have a system which uses this login and it will be on another address, right now everything is on my machine, so this other system ( <code>myMachine.myCompany.com:8080/system/something/index.jsf</code> lets name it <em>app</em>)</p>
  
  <p>My implementation workflow is:</p>
  
  <p>-The user access <strong>app</strong> from jboss<br>
  -It go to a <strong>securityFilter</strong> that check everything on the request (<code>/*</code> on web.xml) to this application<br>
  - The security filter check if the user has a cookie (jboss side)</p>
  
  <pre><code>Cookie[] cookies = request.getCookies();
  if(cookies != null){ 
      for (Cookie cookie : cookies) {
          if (cookie.getName().equalsIgnoreCase("ssoSecurity")) {
              return cookie;
          }
      }
  }
  </code></pre>
  
  <p>-If the user doesn't have the cookie I redirect him to the <strong>login</strong> (tomcat)
  -When the user logs in (enter data to be checked on database) I create a session to this user with a token to identify then later (when needed), cookie on the tomcat server:</p>
  
  <pre><code>Cookie cookie = new Cookie("ssoSecurity", token);
  cookie.setDomain(domain); //.myCompany.com
  cookie.setVersion(0);
  cookie.setPath("/");
  cookie.setSecure(request.isSecure());
  cookie.setMaxAge(-1); //deleted when the browser close
  response.addCookie( cookie );
  </code></pre>
  
  <p>-Then the <strong>login</strong> redirect the user to the <strong>app</strong>, it will again be on securityFilter
  -After the <strong>securityFilter</strong> checks the cookie and find it, it gets its value (token) and call my securityClient (which is a JAR on my classpath to comunicate to the tomcat through rest with json return) to check if the user is loged in (just the first time to create a user session on this server)
  - Then it run the application normally</p>
  
  <p><strong>My problem</strong> is the logout function wich is not working properly. I will explain.</p>
  
  <p>On the <strong>app</strong> the user click on the logout link that will call (<code>#{appUserBean.logout}</code>) my logout method which is:</p>
  
  <pre><code>HttpServletResponse response = (HttpServletResponse)FacesContext
                .getCurrentInstance().getExternalContext()
                .getResponse();
  HttpServletRequest request = (HttpServletRequest)FacesContext
                .getCurrentInstance().getExternalContext()
                .getRequest();
  destroyCookie(getCookie(request), response);
  SSOClient client = new SSOClient(); //from the jar that I mentioned
  client.logout(this.getUserSession().getToken(), request, response);
  </code></pre>
  
  <p>And the <code>destroyCookie</code> method:</p>
  
  <pre><code>private void destroyCookie(Cookie cookie, HttpServletResponse response) {
      if (cookie != null) {
          response.setContentType("text/html");
          cookie.setPath("/");
          cookie.setValue("notValidSession");
          cookie.setComment("EXPIRING COOKIE at " + System.currentTimeMillis());
          cookie.setVersion(0);
          cookie.setDomain(""); //I've tried ".myCompany.com" wont work
          cookie.setMaxAge(0);
          response.addCookie(cookie);
      }
  }
  </code></pre>
  
  <p>This line: <code>client.logout(this.getUserSession().getToken(), request, response);</code> will send the token to the <strong>login</strong> app to logs out the user from the login server (tomcat) and then redirect the user to the login application (tomcat).</p>
  
  <p><strong>The case is that the cookie is not been invalidated nor its value is changing.</strong> So if I don't close the browser and put the link for the <strong>app</strong> the cookie is still there with the user token not with the new value I setted ("notValidSession") And on the tomcat server if I check <code>request.getCookies();</code> it is null as if there is no cookies, but I can see the cookie there on the firefox or chrome resources and with the same value (user token).</p>
  
  <p>I just realized while writing this that I'm not invalidating the user session from the jboss side (I will do that while you guys kindly suggest something or any mistake that you can find) on this approach. </p>
  
  <p>Thanks in advance,</p>