title: How to set secure flag true in spring mvc
body: <p>I am not getting how to set flag secure to true in <code>spring mvc</code>.
  I have tried the following four ways but I'm unable to get any solution:</p>
  
  <p>1) <a href="https://stackoverflow.com/questions/29406002/set-http-only-on-cookies-created-in-spring-mvc-controller">Set http-only on cookies created in Spring MVC Controller</a></p>
  
  <p>2) <a href="https://stackoverflow.com/questions/14989396/forcing-tomcat-to-use-secure-jsessionid-cookie-over-http">Forcing Tomcat to use secure JSESSIONID cookie over http</a></p>
  
  <p>3) <a href="https://www.owasp.org/index.php/SecureFlag" rel="nofollow noreferrer">https://www.owasp.org/index.php/SecureFlag</a></p>
  
  <p>4) <a href="https://www.whitehatsec.com/blog/session-cookie-httponly-flag-java/" rel="nofollow noreferrer">https://www.whitehatsec.com/blog/session-cookie-httponly-flag-java/</a></p>
  
  <p>I have tried this code also and placed in <code>web.xml</code>
  <code>&lt;session-config&gt;
      &lt;session-timeout&gt;20&lt;/session-timeout&gt;
         &lt;cookie-config&gt;
              &lt;secure&gt;true&lt;/secure&gt;
         &lt;/cookie-config&gt;
  &lt;/session-config&gt;</code></p>
  
  <p>but it's not working.</p>
  
  <p>i have tried using <code>java</code>:</p>
  
  <p><code>Cookie cookie = new Cookie("timestamp", new Long(new Date().getTime()).toString());
  cookie.setSecure(true);</code> </p>
  
  <p>I placed above code in <code>Interceptor</code>
   but this is also not working.</p>
  
  <p>When I check in my browser/resources to check whether my flag is set to secure or not.
  but none of the ways is working.
  Please tell me where I am going wrong.</p>