像在Tomcat上一样进行Jetty httpOnly cookie配置

Question

I have Tomcat server on my localhost and on deploy server is Jetty. I use Spring 2.5 with Spring Security 2.0 (Servlets are 2.5). I want to secure session id of our users. I have used these directives to set Tomcat to use HttpOnly cookies.

<context useHttpOnly="true">
...
</context>

And all works fine (on tomcat). Now I want to do the similar thing on Jetty. Is it possible? Or is it possible to manage it only in application context?

Thank you very much.

Answer 1

I think you should be able to easily upgrade to Jetty 8, which supports Servlet 3.0. There you have a standard way for that configuration. See this answer for how to do it in web.xml.