title: httponly and secure flags in java application servlet 3
body: <p>I'm trying to setup an application with httponly and secure flags set to true but as soon as I edit my web.xml file by adding the requested cookie-config tag as follows:</p>
  
  <pre><code> &lt;cookie-config&gt;
         &lt;http-only&gt;true&lt;/http-only&gt;
         &lt;secure&gt;true&lt;/secure&gt;
   &lt;/cookie-config&gt;
  </code></pre>
  
  <p>I get a ViewExpiredException at the first command link submitted.</p>
  
  <p>The complete <code>session-config</code> tag in my web.xml file is</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;5&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;secure&gt;true&lt;/secure&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
      &lt;/cookie-config&gt;
      &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>I've been trying to understand what the error could be but can't find anything.</p>
  
  <p>My managed bean is annotated as @SessionScoped while the command link is calling a method in the bean through ajax.</p>