JSESSIONID is set for both HttpOnly and Secure
java, jsessionid, security, session-cookies
Solution
The HttpOnly cookie attribute is a bit misleadingly named: what it really means is "don't let this cookie be readable by client-side scripts". It is not the opposite of the Secure attribute, and indeed it is very good practice to set both attributes for sensitive cookies that you want to be only readable by the server over HTTPS.
Problem
We have a tomcat instance serving HTTP over an SSL nginx Proxy. We've set the settings for the connector as follows: ``` connectionTimeout="20000" redirectPort="8443" compression="on" compressionMinSize="2048" scheme="https" secure="true" proxyPort="443" compressableMimeType="text/html,text/xml,text/plain,text/css,text/javscript,application/javascript,application/json" ``` The JSESSIONID cookie is created on both HttpOnly and SSL. We want to limit it to SSL only and we can't seem to figure out the logic behind the session cookie creation in Java. Any hint would be very appreciated.