How to get jetty to send jsessionid-cookies with the secure-flag when using a secure channel

Question

I am using Tomcat in my production environment and jetty in my testing environment (via jetty-maven-plugin).

Tomcat sets the secure-flag on a jsessionid-cookie, when it

Answer 1

I am adding the following just to show the complete example that worked for me.

Put the following in WEB-INF/jetty-web.xml

<?xml version="1.0"  encoding="ISO-8859-1"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">

<Configure class="org.eclipse.jetty.webapp.WebAppContext">
    <Get name="sessionHandler">
        <Get name="sessionManager">
            <Set name="secureCookies" type="boolean">true</Set>
        </Get>
    </Get>
</Configure>

Answer 2

The configuration changes needed to set the secureCookies property can be added to the jetty-web.xml file:

<Get name="sessionHandler">
  <Get name="sessionManager">
    <Set name="secureCookies">true</Set>
  </Get>
</Get>