title: Transforming a set-cookie Session Cookie header in Apache after the content is generated in Java
body: <p>How can I have an apache config that takes an original web-page generated by a java application server and transforms the set-cookie session header to have an extra flag.</p>
  
  <p>i.e.</p>
  
  <p><strong>From</strong></p>
  
  <pre><code>Set-Cookie:JSESSIONID=f232xxx; path=/moedev-wss; secure
  </code></pre>
  
  <p><strong>To</strong></p>
  
  <pre><code>Set-Cookie:JSESSIONID=f232xxx; path=/moedev-wss; secure; httponly
  </code></pre>
  
  <p>Unfortunately the java code I have cannot easily be updated, but if I can change the header in Apache, my problems are solved.</p>
  
  <p>Note I have investigated the following Modules:</p>
  
  <ul>
  <li>mod_headers: cannot search content generated by other generators.</li>
  <li>mod_rewrite: doesn't edit content that isn't proxied.</li>
  <li>mod_proxy: doesn't edit content that isn't proxied.</li>
  </ul>
  
  <p>Why would I want to do this?, in short: security issues see <a href="https://www.owasp.org/index.php/HttpOnly" rel="nofollow">OWASP on the subject</a></p>