Forcing Tomcat to use secure JSESSIONID cookie over http

java security tomcat session-cookies
Krešimir Nesek picture Krešimir Nesek · Feb 20, 2013 · Viewed 49.3k times · Source

Is there a way to configure Tomcat 7 to create JSESSIONID cookie with a secure flag in all occasions?

Usual configuration results in Tomcat flagging session cookie with secure flag only if connection is made through https. However in my production scenario, Tomcat is behind a reverse proxy/load balancer which handles (and terminates) the https connection and contacts tomcat over http.

Can I somehow force secure flag on session cookie with Tomcat, even though connection is made through plain http?

Answer

Krešimir Nesek picture Krešimir Nesek · Mar 8, 2013

In the end, contrary to my initial tests, web.xml solution worked for me on Tomcat 7.

E.g. I added this snippet to web.xml and it marks session cookie as secure even when reverse proxy contacts tomcat over plain HTTP.

<session-config>
    <cookie-config>
        <http-only>true</http-only>
        <secure>true</secure>
    </cookie-config>
</session-config>

Related questions

Using Apache httpclient for https

I have enabled https in tomcat and have a self-signed certificate for server auth. I have created an http client using Apache httpClient. I have set a trust manager loading the server certificate. The http client can connect with server …

Read More
Imported certificate to Java keystore, JVM ignores the new cert

I'm trying to get an application running on top of Tomcat 6 to connect to an LDAP server over SSL. I imported certificate of the server to keystore using: C:\Program Files\Java\jdk1.6.0_32\jre\lib\security>keytool -importcert -trustcacerts …

Read More
Add HSTS feature to Tomcat

Trust you all well. My web application run on tomcat 6.0.43 and do not use apache or nginx at front. I'm already enforce my web from http redirect to https using: URL Redirect at ../webapps/ROOT/index.jsp <% response.sendRedirect("…

Read More