java - httpOnly Session Cookie + Servlet 3.0 (e.g. Glassfish v3) -
By default, the glassfish v3 session does not set the same flag only on cookies (when normally the GetSession ()
) is built together.
I know, a method is javax.servlet.SessionCookieConfig.setHttpOnly ()
, but I'm not sure if this is the best way to do this, and if So, where is the best place to place that place?
BTW, of course, can be done in the servlet itself ( not such as init ()):
java.lang.IllegalStateException : PWC1426: The only session to the servlet context / ... is unable to configure the session tracking cookie property, since this servlet theme has already been started
Generally , I have a configuration option such as in Web.xml
This is supported through a servlet 3.0 web.xml
(see ):
& lt; Web-App & gt; & Lt; Session-config & gt; & Lt; Cookie-config & gt; & Lt ;! - Specifies that any session tracking cookies created by this web application will be marked as HTTP - & gt; & Lt; Http-only & gt; True & lt; / -only http & gt; & Lt; / Cookie-config & gt; & Lt; / Session-config & gt; & Lt; / Web application & gt;
Comments
Post a Comment