servlet set cookie secure?

Question

javax.servlet.http.Cookie implements java.lang.Cloneable

In Cookie method, there is a method call "setSecure" , what does it use for? if i setSecure(true), is there anything i need to do on my client(javascript) side to read the cookie? what is different set/without setSecure?

score 9 · Accepted Answer · answered Jan 02 '11 at 13:19

9

All that setSecure(true) does is tell the browser that the cookie should only be sent back to the server if using a "secure" protocol, like https. Your JavaScript code doesn't have to do anything different.

answered Jan 02 '11 at 13:19

T.J. Crowder

1,031,962
187
1,923
1,875

score 3 · Answer 2 · answered Nov 30 '16 at 15:15

Yup this ensures that your session cookie is not visible to an attacker like man-in-the-middle attack. Instead of setting it manually You could alternatively configure your web.xml to handle it for you automatically.

<session-config>
   <cookie-config>
      <secure>true</secure>
   </cookie-config>
</session-config>

servlet set cookie secure?

2 Answers2

Linked