Secure and HttpOnly flags for session cookie Websphere 7

servlets cookies websphere-7 httponly
mmutilva picture mmutilva · Feb 8, 2012 · Viewed 46.3k times · Source

In Servlet 3.0 complaint application servers I can set the HttpOnly and secure flags for the session cookie (JSESSIONID) by adding the following to the web.xml:

<session-config>
  <cookie-config>
    <secure>true</secure>
    <http-only>true</http-only>
  </cookie-config>
</session-config>

However, the application I'm working on is to be deployed in Websphere 7, which is Servlet 2.5 complaint and it fails to start if I add the above to the web.xml

Is there any other declarative way or setting in Websphere 7 configuration to turn on the HttpOnly and secure flags for the session cookie?

If not, what would be the best approach to accomplish that programmatically?

Answer

planetjones picture planetjones · Feb 8, 2012

I think in WebSphere 7 you may have to delve into the administrative console. As ever the WebSphere documentation seems poor but seems to suggest setting the com.ibm.ws.security.addHttpOnlyAttributeToCookies property:

Both the Secure flag and the HTTPOnly flag are enabled by setting the WebSphere Application Server property: com.ibm.ws.security.addHttpOnlyAttributeToCookies.

I found this, which I hope is applicable to WAS7. Can you try please (I only have WAS 8 at the moment on my system):

JSESSIONID cookie:

Secure Flag:

The Secure flag can be set within the WebSphere Application Server administrative interface by selecting AppServer->[Server Name]->Web Container Settings->Session Management. Check the checkbox for “Restrict cookies to HTTPS Sessions”.

HTTPOnly Flag:

The HTTPOnly attribute cannot currently be set on this cookie. This is registered on the IBM site as APAR PK98436. The fix for this APAR is currently targeted for inclusion in Fix Packs 6.1.0.31 and 7.0.0.9, which are not yet available. With this APAR in place, the HTTPOnly flag can be set on the JSESSIONID cookie by way of the property name: com.ibm.ws.webcontainer.httpOnlyCookies. Refer to the following technote for instructions on enabling WebContainer custom properties.

The com.ibm.ws.webcontainer.httpOnlyCookies property is documented on the WAS 7 help site.

Related questions

How do you remove a Cookie in a Java Servlet

How do you remove a cookie in a Java servlet? I tried this: http://www.jguru.com/faq/view.jsp?EID=42225 EDIT: The following now works successfully it appears to be the combination of: response.setContentType("text/html"); and cookie.…

Read More
Differences between cookies and sessions?

I am training in web developement and am learning about JSP & Servlets. I have some knowledge of HttpSession - I have used it in some of my sample projects. In browsers I have seen the option to "delete cookies". …

Read More
Best option for Session management in Java

Best way managing session in Java. I heard that cookies are not reliable option for this as they gets stored into browser and can be accessed later on? Is this correct? If possible please come up with the answers with …

Read More