title: Secure and HttpOnly flags for session cookie Websphere 7
body: <p>In Servlet 3.0 complaint application servers I can set the HttpOnly and secure flags for the session cookie (JSESSIONID) by adding the following to the web.xml:</p>
  
  <pre><code>&lt;session-config&gt;
    &lt;cookie-config&gt;
      &lt;secure&gt;true&lt;/secure&gt;
      &lt;http-only&gt;true&lt;/http-only&gt;
    &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>However, the application I'm working on is to be deployed in Websphere 7, which is Servlet 2.5 complaint and it fails to start if I add the above to the web.xml</p>
  
  <p>Is there any other declarative way or setting in Websphere 7 configuration to turn on the HttpOnly and secure flags for the session cookie?</p>
  
  <p>If not, what would be the best approach to accomplish that programmatically? </p>