Setting the Session Secure Only Flag Programmatically

java

Solution

I found the answer. Here it is for the benefit of others:

public void contextInitialized(ServletContextEvent servletContextEvent) {
    ServletContext servletContext = servletContextEvent.getServletContext();
    SessionCookieConfig scc = servletContext.getSessionCookieConfig();
    scc.setSecure(true);
}

The code should obviously be added to your app's context listener.

Problem

In web.xml, you can make sure that the session cookie (JSESSIONID) is set as an SSL only cookie by the following: ``` <session-config> <cookie-config> <secure>true</secure> </cookie-config> </session-config> ``` Is there a way to achieve the same thing programmatically when you create the session?

Original source