<p>I'd like to add the <code>HttpOnly</code> flag to <code>JSF/richfaces</code> cookies, especially the session cookie, to up the level of security on my web app. Any ideas? </p>

[{'answer_id': 72371, 'author': 'Mo.', 'author_id': 1870, 'author_profile': 'https://Stackoverflow.com/users/1870', 'pm_score': 0, 'selected': False, 'text': '<p>Something like:</p>\n\n<pre><code>response.setHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");\n</code></pre>\n\n<p>might work in a Java environment. I am not aware of a JSF-specific way to achieve this... sorry</p>\n\n<p>This seems to be not an easy task in Java.</p>\n'}, {'answer_id': 72722, 'author': 'Steve g', 'author_id': 12092, 'author_profile': 'https://Stackoverflow.com/users/12092', 'pm_score': 1, 'selected': False, 'text': '<p>There may be something that allows you to do this in your servlet engine.  This is part of the Servlet 3.0 spec which is yet to be released.</p>\n'}, {'answer_id': 73220, 'author': 'sblundy', 'author_id': 4893, 'author_profile': 'https://Stackoverflow.com/users/4893', 'pm_score': 0, 'selected': False, 'text': "<p>I suspect that I'll need to use a filter to add a response wrapper, which'll add the flag to all cookies as they're added by the framework. </p>\n"}, {'answer_id': 75371, 'author': 'user13229', 'author_id': 13229, 'author_profile': 'https://Stackoverflow.com/users/13229', 'pm_score': 1, 'selected': False, 'text': '<pre><code>FacesContext facesContext = FacesContext.getCurrentInstance().getFacesContext();\n\nHttpServletResponse response = (HttpServletResponse) facesContext.getExternalContext().getResponse();\n\nresponse.addHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/72304', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4893/']