Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>For session cookies it doesn't seem to be supported in Tomcat yet. See the bug report <a href="https://issues.apache.org/bugzilla/show_bug.cgi?id=44382" rel="noreferrer">Need to add support for HTTPOnly session cookie parameter</a>. A somewhat involved work-around for now can be found <a href="http://manicode.blogspot.com/2008/03/httponly-support-for-apache-tomcat.html" rel="noreferrer">here</a>, which basically boils down to manually patching Tomcat. Can't really find an easy way to do it at this moment at this point I'm affraid. </p> <p>To summarize the work-around, it involves downloading the 5.5 <a href="http://tomcat.apache.org/tomcat-5.5-doc/building.html" rel="noreferrer">source</a>, and then change the source in the following places:</p> <p><em>org.apache.catalina.connector.Request.java</em></p> <pre><code>//this is what needs to be changed //response.addCookieInternal(cookie); //this is whats new response.addCookieInternal(cookie, true); } </code></pre> <p><em>org.apache.catalina.connectorResponse.addCookieInternal</em></p> <pre><code>public void addCookieInternal(final Cookie cookie) { addCookieInternal(cookie, false); } public void addCookieInternal(final Cookie cookie, boolean HTTPOnly) { if (isCommitted()) return; final StringBuffer sb = new StringBuffer(); //web application code can receive a IllegalArgumentException //from the appendCookieValue invokation if (SecurityUtil.isPackageProtectionEnabled()) { AccessController.doPrivileged(new PrivilegedAction() { public Object run(){ ServerCookie.appendCookieValue (sb, cookie.getVersion(), cookie.getName(), cookie.getValue(), cookie.getPath(), cookie.getDomain(), cookie.getComment(), cookie.getMaxAge(), cookie.getSecure()); return null; } }); } else { ServerCookie.appendCookieValue (sb, cookie.getVersion(), cookie.getName(), cookie.getValue(), cookie.getPath(), cookie.getDomain(), cookie.getComment(), cookie.getMaxAge(), cookie.getSecure()); } //of course, we really need to modify ServerCookie //but this is the general idea if (HTTPOnly) { sb.append("; HttpOnly"); } //if we reached here, no exception, cookie is valid // the header name is Set-Cookie for both "old" and v.1 ( RFC2109 ) // RFC2965 is not supported by browsers and the Servlet spec // asks for 2109. addHeader("Set-Cookie", sb.toString()); cookies.add(cookie); } </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload