how to set httponly and session cookie for java web application

Question

I am working on an XSS (cross site scripting) issue. My application runs on an Oracle Weblogic portal. We use Servlet version 2.5.

I have added the below 3 lines of code in the filter for setting httponly and secure cookies, and it is working fine.

String sessionid = req.getSession().getId();
res.setHeader("Set-Cookie", "JSESSIONID=" +  sessionid + ";HttpOnly");
res.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; secure");

The issue is when I logout and login immediately in the same browser. I am able to login, but after that, on the jsp pages I am getting a session timeout issue. We use weblogic related apis. The request.getuserprinical() api is returning null.. guess it is setting to null.

Please share any ideas.

If there are any other ways to set httponly or secure flag, please help.

Jason Nichols · Accepted Answer · 2017-05-24T14:46:36.180

20

Depending on the specifics of your web container, modifying container-managed session cookies within an app can cause the app server to toss the existing session and create a new one. I've observed this on Tomcat but it may be similar for Weblogic.

If you're using Servlets 3.0, you can actually instruct the app server to ensure that all session cookies are HttpOnly and Secure with the following fragments:

<session-config>
  <cookie-config>
    <secure>true</secure>
    <http-only>true</http-only>
  </cookie-config>
</session-config>

This is a better approach than manually hacking on the cookies with a filter.

FYI: I've also written a Java library that injects a number of security related response headers in Servlet based apps.

edited May 24 '17 at 14:46

answered Jul 16 '13 at 23:19

Jason Nichols

11,603
5
34
53

Could you check this question Jason? http://stackoverflow.com/questions/28341645/is-it-possible-to-use-https-only-for-login-in-spring-security I think you could help a lot and it has similarities to this question :) – mannuk Feb 05 '15 at 16:24
I had to swap the lines and , otherwise the web.xml would be invalid. – Alexander Jun 25 '18 at 07:55

score 1 · Answer 2 · edited Oct 23 '19 at 03:37

1

You need to use following syntax to set both httponly and Secure flags

JSESSIONID=ABC3423DF...SDF;HttpOnly;Secure

edited Oct 23 '19 at 03:37

Rahul Mahadik

11,668
6
41
54

answered Apr 22 '13 at 13:41

Koray Güclü

2,857
1
34
30

score -2 · Answer 3 · answered Nov 16 '17 at 05:23

-2

I have used <http-only> and <secure> tags in web.xml to set the secure attributes and it worked.

<session-config>
 <cookie-config>
  <http-only>true</http-only>
 </cookie-config>
<session-config>

answered Nov 16 '17 at 05:23

Jayampathy Wijesena

1,670
1
18
26

how to set httponly and session cookie for java web application

3 Answers3

Linked