Setting httponly in JSESSIONID cookie (Java EE 5)

Question

I\'m trying to set the httponly flag on the JSESSIONID cookie. I\'m working in Java EE 5, however, and can\'t use setHttpOnly(). First I tried to create my ow

Answer 1

Since the JSESSIONID cookie is managed by the servletcontainer, this setting is servletcontainer specific. It's unclear which one you're using, so here's an Apache Tomcat 6.0 targeted answer so that you know in which direction you'll have to look for your servletcontainer: you need to set the useHttpOnly attribute of the webapplication's element to true.

    ...

Also see this Tomcat documentation about the element.