1

how to enable httponly for jsessionid cookie in jboss 4.2.3 ?

Note :jboss 4.2.3 is having implementation of servlet 2.4

Vijay Kumar Kamannavar
  • 71
  • 4

1 Answers1

1

I'm afraid you can't... For the same kind of requirement, I had to patch tomcat class.

in tomcat's org.apache.tomcat.util.http.ServerCookie.java

you can add this kind of properties by changing code on the appendCookieValue method (you can also check on witch cookie you want to apply this ... )

Greg Henry
  • 61
  • 6