Add HttpOnly and Secure attributes to JSESSIONID cookie

[kalyancm]

Hi,

We are using JBoss 4.3 CP 09 server for our applications. SSL is not provided by the server but by an external component. I would like the 'HttpOnly' and 'secure' attributes to be added to the JSESSION ID cookie generated by one application. For this server version, the only way that I seem to find is to use a Servlet Filter and add the JSESSIONID as below.

public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain filterChain) throws IOException, ServletException {

        final HttpServletResponse response = (HttpServletResponse) res;

        final HttpServletRequest request = (HttpServletRequest) req;

        if (response.containsHeader("SET-COOKIE")) {  // *******

            response.setHeader("SET-COOKIE", "JSESSIONID=" + request.getSession().getId() + "; Path=" + request.getContextPath()

                    + "; HttpOnly" + (request.isSecure() ? SECURE_FLAG : ""));

        }

        filterChain.doFilter(req, res);

}

Is there a better approach than doing it this way? I would prefer to let the server handle the cookie.

Also response.containsHeader("SET-COOKIE") always seem to return false.

Please provide your suggestions.

Thanks

Kalyan Matha

[jfclere]

may be the external component could add the header for you, what are you using?

[kalyancm]

Thanks for responding to my question. I will try to find some info about the external component that provides SSL to our application.Your suggestion was one approach that we were considering for resolving this issue. Before taking that approach, I would like to know if the programming approach as mentioned above is incorrect.

[jfclere]

the HttpOnly is discussed in https://community.jboss.org/message/761627

for the isSecure() the trick is to configure the connector so that AS thinks it is secured secure="true" in the connector configuration.


[kalyancm]

Thanks for your pointers. I will try the suggestions in the referenced thread.

[naresh1]

Hi kalyan,

Did you resolve your issue, Got same thing can you help me out?

Thanks,

Naresh kallamadi