How to set secure flag for cookies in play 2.4.x

Question

I see this used to be set with a conf value for play 2.1.0

But in 2.4.x I see that this has been moved to using HttpConfiguration instead, what needs to be done now to put the secure flag on cookies now?

Answer 1

You have multiple options to set the secure flag depending on which type of cookie you are talking about:

For the session cookie add the following in your application.conf file:

play {
   http {
       session = {
           secure = true
       }
   }
}

If you already configured the session cookie to be secure, all other cookies will be handled the same way unless you specify otherwise.

To change the configuration for regular cookies place the following in your application.conf file:

play.filters {
    cookie {
       secure = true
    }
}

See Filter reference.conf and Play reference.conf for all configuration options that you have for cookies and the session.