title: How do I get Spring generated cookies to expire when browser is closed?
body: <p>A Spring Boot app has REST services that set cookie values inside a Spring Controller and then send the cookies out to the client in the response using <code>HttpServletResponse</code> as follows:  </p>
  
  <pre><code>response.addCookie(new Cookie("AUTH1", "no"));
  </code></pre>
  
  <p>But when I close firefox, then re-open firefox and call the app's url again, the cookie values are exactly the same.  <strong>How can I make sure that cookie values are destroyed when the browser closes, so that the cookies do not exist when the browswer is re-opened?</strong>  Can this be configured in the Spring Boot app?  Or do I need to configure it in the front end app?</p>
  
  <hr>
  
  <p><strong>ONGOING EFFORTS:</strong>  </p>
  
  <p>Changing all the <code>response.setCookie()</code> lines in the backend REST controller to <code>session.setAttribute()</code> lines for the same key value pairs did not produce anything that the AngularJS client app could read using <code>$cookies.get('keyname')</code> even though they were the same key names.  <strong>Is there a way to set session cookies in Spring controllers that will automatically be destroyed when the user closes their browser?</strong>  </p>
  
  <p>I also tried to implement <code>@shazin</code>'s suggestion by using a method (because cookies are recreated many times in the controller class), but the problem is only partially resolved.  Specifically, I took the following steps:  </p>
  
  <p>1.) I started with a couple of browser windows open, only one of which contained the app being tested.<br>
  2.) I changed all the code as shown below,<br>
  3.) then I killed the app with control-C and also killed the process running on the port.<br>
  4.) Then I <code>mvn clean package</code><br>
  5.) and then I start up the app again with <code>java -jar jarname</code>, and load it up in a new InPrivate browser window.<br>
  6.) I use the logout method to remove any cookies that might have lingered from previous versions,<br>
  7.) then I use the GUI to trigger new cookie definitions, which work as intended.<br>
  8.) But then I test by closing the browser window that contains the app being tested and then re-opening a new browser window and navigating to the site again, <strong>but the cookie values are still there, so this approach has not solved the problem.</strong><br>
  9.) Finally, I closed both open browser windows (each browser window has a few tabs of its own open.  After closing all the browser windows, I opened a new browser window, and found that the cookies had been removed.  <strong>So the approach below only works if you close ALL open browser windows and not just the browser window containing the app.</strong>  </p>
  
  <p>Here is the method that I wrote to implement @shazin's suggestion:  </p>
  
  <pre><code>public Cookie getTempCookie(String key, String val){
      Cookie tempCookie = new Cookie(key, val);
      tempCookie.setMaxAge(-1);
      return tempCookie;
  }
  </code></pre>
  
  <p>And here is how I call the method from the various url pattern handlers inside the controller:  </p>
  
  <pre><code>response.addCookie(getTempCookie("AUTH1", "yes"));
  </code></pre>
  
  <p><strong>What else can I do to get the cookies to be deleted when only the window containing the app gets closed?</strong>  In its present form, there is still a security risk if a user closes their browser window without realizing that another browser window is still opened.  </p>