title: Forcing Tomcat to use secure JSESSIONID cookie over http
body: <p>Is there a way to configure Tomcat 7 to create JSESSIONID cookie with a secure flag in all occasions? </p>
  
  <p>Usual configuration results in Tomcat flagging session cookie with secure flag only if connection is made through https. However in my production scenario, Tomcat is behind a reverse proxy/load balancer which handles (and terminates) the https connection and contacts tomcat over http.</p>
  
  <p>Can I somehow force secure flag on session cookie with Tomcat, even though connection is made through plain http?</p>