how do I test httpOnly cookie flag

websphere session-cookies httponly
streed picture streed · Nov 30, 2010 · Viewed 43k times · Source

I have set the following property in websphere for the jsession cookie com.ibm.ws.webcontainer.HTTPOnlyCookies.

Any idea how best to test this using JavaScript in Firefox or IE?

Answer

joocer picture joocer · Aug 21, 2012

It's a pain in IE. I have IE9 so your screens may be different.

Press F12, go to the network tab, and then press Start Capturing. Back in IE then open the page you want to view. Back in the F12 window you show see all the individual HTTP requests, select the one that's the page or asset you're checking the cookies on and double click on it. You should then be able to see all the response headers and cookies on their relevant tabs.

Edit:

A HttpOnly Cookie would look something like this:

Set-Cookie: SessionId=z5ymkk45aworjo2l31tlhqqv; path=/; HttpOnly

The cookie may not be sent with every response, so you may need to clear all of your cookies and then try again to make sure one is sent with the request you're monitoring.

Related questions

SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder"

My application is to be deployed on both tcServer and WebSphere 6.1. This application uses ehCache and so requires slf4j as a dependency. As a result I've added the slf4j-api.jar (1.6) jar to my war file bundle. The application …

Read More
JSTL if tag for equal strings

I've got a variable from an object on my JSP page: <%= ansokanInfo.getPSystem() %> The value of the variable is NAT which is correct and I want to apply certain page elements for this value. How do I use …

Read More
(SC) DeleteService FAILED 1072

Last time I create WAS profile and WASService then I try to config and run many script for learn how to config WAS, Finally it crash so i use wasprofile delete this profile and forgot delete WASService. Now I found …

Read More