Setting 'HttpOnly' and 'Secure' in web.xml

security session cookies web.xml httponly
EH Khiari picture EH Khiari · Jun 14, 2017 · Viewed 25k times · Source

I need to have the 'HttpOnly' and 'Secure' attributes set to 'true' to prevent the CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute and CWE-402: Transmission of Private Resources into a New Sphere flaws from showing in the Veracode report.

After doing some online searching, it seems that the best thing to do is to simply set the attributes in the project's web.xml file as follows:

<session-config>
    <cookie-config>
        <http-only>true</http-only>
        <secure>true</secure>
    </cookie-config>
 </session-config>

However, I get an error message on the opening tag saying that "The content of element type "session-config" must match "(session-timeout)?".

I'm not sure what that means exactly. I'm guessing it has something to do with the order of elements but I don't really know how to fix it.

Any thoughts?

Thanks!

Answer

Alessandro Proscia picture Alessandro Proscia · Jul 10, 2017

The support for secure and http-only attribute is available only on http-servlet specification 3. Check that version attribute in your web.xml is "3.0".

<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
            http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
     version="3.0">

Related questions

What is the best way to prevent session hijacking?

Specifically this is regarding when using a client session cookie to identify a session on the server. Is the best answer to use SSL/HTTPS encryption for the entire web site, and you have the best guarantee that no man …

Read More
Harm of passing session id as url parameter

So I just noticed that one of the internet banks websites is passing session id as url parameter. ( See image below ) I didn't previously see anywhere that ';' in url, in this case it is after 'private;'. 1) What …

Read More
"Keep Me Logged In" - the best approach

My web application uses sessions to store information about the user once they've logged in, and to maintain that information as they travel from page to page within the app. In this specific application, I'm storing the user_id, first_…

Read More