how to set JSESSIONID cookie as secure using Spring security 2 and Apache Tomcat 7 setting

Question

how to set JSESSIONID cookie as secure using Spring security 2 and Apache Tomcat 7 setting.

have put in the code below in web.xml and it deosn't seem to be working.

<cookie-config>
   <secure>true</secure>
</cookie-config>

thanks

Answer 1

Use the following:

<session-config>
  <cookie-config>
    <secure>true</secure>
    <http-only>true</http-only>
  </cookie-config>
</session-config>