Tomcat 7 - JSESSIONID cookie is not accessible from JavaScript code

Question

Does anyone know what changed in the configuration between Tomcat 6 and Tomcat 7 that would cause the JSESSIONID cookie to not be accessible via JavaScript?

Using Tomcat 6:

alert(document.cookie); // JSESSIONID=8675309ABCDEF...

Using Tomcat 7:

alert(document.cookie); // nothing

In case it's not clear, the first line is what happens in Tomcat 6, the second in Tomcat 7 — Jeff R., Dec 13 '11 at 19:55

score 13 · Accepted Answer · edited Jul 23 '12 at 15:43

Okay, I found the answer. The useHttpOnly attribute was set to false by default in Tomcat 6, and is true in Tomcat 7. This attribute is set for the <Context> container.

<Context useHttpOnly="false" [...] />

For more information about updating from Tomcat 6 to 7: Migrating from 6.0.x to 7.0.x

I'm not sure why I didn't see that in the docs before, but I've verified that setting this to false does in fact cause Tomcat 7 to revert to the Tomcat 6 behavior.

Tomcat 7 - JSESSIONID cookie is not accessible from JavaScript code

1 Answers1

Linked