title: Solve "missing secure attribute in encrypted session (ssl) cookie" with Java
body: <p>Recently, IBM Security AppScan found an issue that missing secure attribute in encrypted session (ssl) cookie. the report is below:</p>
  
  <p><a href="https://i.stack.imgur.com/42qj5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/42qj5.png" alt="enter image description here"></a></p>
  
  <p>this app is code by Java and i add a filter to set all cookies secure, code:</p>
  
  <pre><code>public class BasicFilter implements Filter {
  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
  }
  @Override
  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
      HttpServletRequest req = (HttpServletRequest) servletRequest;
      Cookie[] cookies = req.getCookies();
      HttpServletResponse resp = (HttpServletResponse) servletResponse;
      if( cookies != null &amp;&amp; cookies.length &gt; 0) {
          for (int i = 0; i &lt; cookies.length; i++) {
              cookies[i].setSecure(true);
              cookies[i].setHttpOnly(true);
              resp.addCookie(cookies[i]);
          }
      }
      filterChain.doFilter(req,resp);
  }
  
  @Override
  public void destroy() {
  
  }
  </code></pre>
  
  <p>}</p>
  
  <p>it's works while all cookies response twice like that and it will try to login over and over(login with <strong>SSO</strong>): </p>
  
  <p><a href="https://i.stack.imgur.com/fLkA5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fLkA5.png" alt="enter image description here"></a></p>
  
  <p>Thanks for your kindly help and how can i do to enable secure and solve cookie issue, hope you guys can give me some idea to solve this issue.
  Thanks!</p>