    private void markCookieAsHttpOnly(ServletContext context) {
        try {
            Method m;
            try {
                m = context.getClass().getMethod("getSessionCookieConfig");
            } catch (NoSuchMethodException x) { // 3.0+
                LOGGER.log(Level.FINE, "Failed to set secure cookie flag", x);
                return;
            }
            Object sessionCookieConfig = m.invoke(context);

            // not exposing session cookie to JavaScript to mitigate damage caused by XSS
            Class scc = Class.forName("javax.servlet.SessionCookieConfig");
            Method setHttpOnly = scc.getMethod("setHttpOnly",boolean.class);
            setHttpOnly.invoke(sessionCookieConfig,true);
        } catch (Exception e) {
            LOGGER.log(Level.WARNING, "Failed to set HTTP-only cookie flag", e);
        }
    }
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.