Setting Secure Flag on JSESSION cookie

[pawel.masloch]

Hello,

I wonder if anyone has ever had a requirement to set secure flag on JSESSIONID cookie and what needed to be done to successfully complete the task?

Please note adding <secure>true</secure> to <session> => <cookie> works only over https - otherwise the form is not accessible (even when secure form is forced in form property).

Thanks.

[Hovik]

Did you add the secure flag to web.xml? e.g.

change:

Code: Select all

      <session-config>
         <session-timeout>30</session-timeout>
      </session-config>

to:

Code: Select all

      <session-config>
         <session-timeout>30</session-timeout>
         <cookie-config>
             <http-only>true</http-only>
             <secure>true</secure>
         </cookie-config>
      </session-config>