title: How to flag session cookie as secure (https only) in tomcat 6
body: <p>I have done a lot of googeling and could not find an answer. I have tried setting the following in the web.xml file in the war with no impact :</p>
  
  <pre><code>&lt;session-config&gt;
          &lt;session-timeout&gt;60&lt;/session-timeout&gt;
          &lt;cookie-config&gt;
              &lt;http-only&gt;true&lt;/http-only&gt;
              &lt;secure&gt;true&lt;/secure&gt;
          &lt;/cookie-config&gt;
      &lt;/session-config&gt;
  </code></pre>
  
  <p>Adding useHttpOnly in the tomcat context.xml file works to restrict cookies to http only but I still need to make them secure. </p>