How to mark JSESSIONID secure in tomcat?

Question

I want to mark my JSESSIONID cookie generated by tomcat(version 8) as secure. im using java 12 ...

So far i have tried

1. in tomcat web.xml file, i have added

    <cookie-config>
    <http-only>true</http-only>
    <secure>true</secure>
    </cookie-config>

in session-config section

2. tried, cookie.setSecure(true) in my servlet

both not working.. any better solution?

Answer 1

There are 2 flag should be maintain to avoid Session cookies hijacking(HttpOnly, Secure)

Set-Cookie: JSESSIONID=T8zK7hcII6iNgA; Expires=Wed, 21 May 2018 07:28:00 GMT; HttpOnly; Secure

For Servlet 3.0 the configuration as

<session-config>
    <cookie-config>
      <http-only>true</http-only>
      <secure>true</secure>
    </cookie-config>
</session-config>