How to set secure cookie in Java/Spring MVC on Heroku?

Question

Based on my research, in order to have all cookies be secure, server.xml needs to be modified, but heroku's webapp runner doesn't give you access to it. Is there a way to do it through a servlet filter or some spring mvc filter?

Answer 1

If you can, require HTTPS - in that case Tomcat does the right thing (with the session cookie, at least - see How to flag session cookie as secure (https only) in tomcat 6 ). On Heroku, the trick is making sure Tomcat knows the request is secure - by default on Heroku it doesn't, since the inbound request is proxied, and SSL is handled in the routing mesh. Ie, request.isSecure() will return false

However, webapp-runner lets you specify a context.xml ; in there you can configure RemoteIpValve so that Tomcat will pick up various x_forwarded headers and adjust the request accordingly (ie, if an HTTPS request is made to the routing mesh, request.isSecure() will now be true, even through Tomcat only saw the request as HTTP. I did something similar, documented here: SSL redirects in Heroku

Hope that helps.