title: The fileDownloaded cookie is sent over a secure connection but does not have the "secure" attribute set
body: <p>A security scan performed on my tomcat install is reporting this problem: </p>
  
  <p>The fileDownloaded cookie is sent over a secure connection but does not have the "secure" attribute set. The "secure" attribute tells the browser to only transmit cookies over connections secured with SSL. This protects the values from being inadverntly sent over unencrypted HTTP connections.</p>
  
  <p>I've gone through and set the secure="true" in server.xml and set useHttpOnly="true" in context.xml</p>
  
  <p>This fixed the issue on all the actual pages they now all show Set Cookie secure in the header</p>
  
  <p>But this fileDownlaoded cookie is the last lingering bit reporting a problem.</p>
  
  <p>I've searched everywhere and can't seem to find any reference to anyone else having this problem. </p>
  
  <p>I'm starting to wonder if this is actually a configuration issue with the iPlanet Web Server and not the Tomcat App Server</p>
  
  <p>Request</p>
  
  <pre><code>GET ------ HTTP/1.1
  Host: www
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
  Cookie: JSESSIONID=*****
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
  Accept-Language: en-US,en;q=0.5
  Referer: https://********dashboard.page
  Connection: keep-alive
  Content-Length: 0
  </code></pre>
  
  <p>Response</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: none
  Date: Sun, 23 Aug 2015 05:08:05 GMT
  X-frame-options: SAMEORIGIN
  Location:
  Proxy-agent: Oracle-iPlanet-Web-Server/7.0
  Content-disposition: attachment; filename="table_export.xls"
  Set-cookie: fileDownloaded=true;Version=1
  Content-type: application/vnd.ms-excel
  Via: 1.1 *******
  Content-Length: 4608
  </code></pre>