java - httpOnly Session Cookie + Servlet 3.0 (e.g. Glassfish v3) -


By default, the glassfish v3 session does not set the same flag only on cookies (when normally the GetSession () ) is built together.

I know, a method is javax.servlet.SessionCookieConfig.setHttpOnly () , but I'm not sure if this is the best way to do this, and if So, where is the best place to place that place?

BTW, of course, can be done in the servlet itself ( not such as init ()):

  java.lang.IllegalStateException : PWC1426: The only session to the servlet context / ... is unable to configure the session tracking cookie property, since this servlet theme has already been started  

Generally , I have a configuration option such as in Web.xml

This is supported through a servlet 3.0 web.xml (see ):

& lt; Web-App & gt; & Lt; Session-config & gt; & Lt; Cookie-config & gt; & Lt ;! - Specifies that any session tracking cookies created by this web application will be marked as HTTP - & gt; & Lt; Http-only & gt; True & lt; / -only http & gt; & Lt; / Cookie-config & gt; & Lt; / Session-config & gt; & Lt; / Web application & gt;

Comments

Popular posts from this blog

windows - Heroku throws SQLITE3 Read only exception -

lex - Building a lexical Analyzer in Java -

python - rename keys in a dictionary -