in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [763:785]
public void set(HttpServletRequest request, HttpServletResponse response, String authData,
AuthenticationInfo info) {
// base64 encode to handle any special characters
String cookieValue = Base64.encodeBase64URLSafeString(authData.getBytes(StandardCharsets.UTF_8));
// send the cookie to the response
String cookieDomain = (String) info.get(COOKIE_DOMAIN);
if (cookieDomain == null || cookieDomain.length() == 0) {
cookieDomain = defaultCookieDomain;
}
if (!isValidCookieDomain(request, cookieDomain)) {
log.warn("Sending formauth cookies without a cookie domain because the configured value is invalid for the request");
cookieDomain = null;
}
setCookie(request, response, this.cookieName, cookieValue, -1, cookieDomain);
// send the cookie domain cookie if domain is not null
if (cookieDomain != null) {
setCookie(request, response, this.domainCookieName, cookieDomain, -1, cookieDomain);
}
}