title: Turn off HttpOnly Spring boot
body: <p>I would like to turn off HttpOnly sessions which I believe are default for Spring Boot. 
  How would I turn off HttpOnly on spring boot?</p>
  
  <p>I currently have code such as: </p>
  
  <pre><code>@RequestMapping(value = "/stuff", method = GET)
  public @ResponseBody
  myObject doStuff(HttpSession session)
  {
          session.setAttribute("foo", "bar");
          return  new MyObject();
  }
  </code></pre>
  
  <p>This returns a response header on the HTTP call:</p>
  
  <pre><code>Set-Cookie: JSESSIONID=D14846D9767B6404F1FB4B013AB66FB3; Path=/; HttpOnly 
  </code></pre>
  
  <p>Note the HttpOnly flag. I would like to turn that off. How do I do so?</p>
  
  <p>Side note: Yes I know that httpOnly is a security feature and by turning it off allows javascript to access my cookie i.e. XSS. </p>
  
  <p>Also, I do not have any configuration other than default.</p>
  
  <pre><code>@ComponentScan
  @EnableAutoConfiguration
  public class WebApplication {
  
      public static void main(String[] args) {
          SpringApplication app = new SpringApplication(WebApplication.class);
          app.run(args);
      }
  }
  </code></pre>