title: weblogic jsessionid cookie-secure
body: <p>I want to set session cookie to "secure", but I want to be able to access the app with http on some test boxes and https in upper environments.</p>
  
  <p>I am setting JSESSIONID to cookie-secure=true this way:</p>
  
  <p>weblogic.xml:</p>
  
  <pre><code>&lt;session-descriptor&gt;
      &lt;cookie-http-only&gt;true&lt;/cookie-http-only&gt;
      &lt;cookie-secure&gt;true&lt;/cookie-secure&gt;
  &lt;/session-descriptor&gt;
  </code></pre>
  
  <p>HTTPS requests work fine, but every request on non-ssl protocol yields a new JSESSIONID. Is there some other setting I can use to conditionally set cookie-secure ?</p>