# Keycloak get cookie SPI

**URL:** <https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160>\
**Category:** Extending the server\
**Created:** [July 21, 2021, 4:35pm UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160 "2021-07-21T16:35:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nelsonVE](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nelsonve/32/3558_2.png) [@nelsonVE](https://forum.keycloak.org/u/nelsonVE)\
**Post date:** [July 21, 2021, 4:35pm UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160/1 "2021-07-21T16:35:42Z")

</div>

Hello!  
I have one question, i’ve made a custom event provider for login event, i need to know if i can pass a custom value from the form to the LOGIN event and get it, i don/t know if i can do that through cookies or something

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [July 21, 2021, 4:59pm UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160/2 "2021-07-21T16:59:02Z")

</div>

I don’t believe there is a way to do this directly. The only way I could think of doing this would be to add a custom Authenticator to the login flow which sets a note in the `UserSessionModel`. Then, in the event, you can use the `sessionId` to get the `UserSessionModel` from `keycloakSession.sessions().getUserSession(realm, sessionId)`.

---

<div class="post-metadata">

**Author:** ![summersab](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/summersab/32/3514_2.png) [@summersab](https://forum.keycloak.org/u/summersab)\
**Post date:** [July 28, 2021, 7:10pm UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160/3 "2021-07-28T19:10:36Z")

</div>

This may be a gross way to do it, but I created an authenticator that sets form fields to:  
`context.getAuthenticationSession().setAuthNote("note", "val");`

One might argue that this isn’t secure because other extensions can access the auth notes, but they’re cleared when the session ends, so I figured it would be alright.

Here’s an example:

> **[GitHub - summersab/keycloak-form-parameter-authenticator](https://github.com/summersab/keycloak-form-parameter-authenticator/)**
>
> Contribute to summersab/keycloak-form-parameter-authenticator development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![nelsonVE](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nelsonve/32/3558_2.png) [@nelsonVE](https://forum.keycloak.org/u/nelsonVE)\
**Post date:** [July 29, 2021, 9:37am UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160/4 "2021-07-29T09:37:07Z")

</div>

Thanks! That worked for me 🙂

If anyone have to do something similar:

I’ve just made a custom authenticator and on the action method i get the variable sended from a hidden input that i put on the login.ftl template. You can easily get the form data using the context and getDecodedFormParameters(), then we get the session (located in the context too) and set a note with the variable that i need. After all that, i just get the session note in another SPI that controls the login event and save it into an user attribute

---

<div class="post-metadata">

**Author:** ![summersab](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/summersab/32/3514_2.png) [@summersab](https://forum.keycloak.org/u/summersab)\
**Post date:** [July 29, 2021, 2:25pm UTC](https://forum.keycloak.org/t/keycloak-get-cookie-spi/10160/5 "2021-07-29T14:25:30Z")

</div>

Sweet! Glad I could help. I’ve only been using Keycloak for about two weeks, but I’ve picked it up pretty quickly. I just hope my code isn’t sloppy or insecure (unsecure? “Insecure” always makes it sound like my code has personal problems).