title: Chrome cookies not working after tomcat web server reboot
body: <p>I noticed recently, that when I reboot my Tomcat web server, that the Chrome browser can no longer store cookies.  i.e. tomcat uses cookies for http sessions, and the browser can no longer get its http session, also the cookie we use to store the logged in user fails, and the user does not remain logged in.</p>
  
  <p>This seems to be a new issue with Chrome, perhaps from a recent update, I do not remember seeing it before. If I close the Chrome browser, then reopen it, it is fine again (until the server is rebooted again).</p>
  
  <p>The issue does not happen on Firefox, seems like a bug in Chrome.</p>
  
  <p>Has anyone else noticed this issue, or know of a solution?</p>
  
  <p>I found some posts about Chrome/tomcat cookie issues and the suggestion to set,
  sessionCookiePathUsesTrailingSlash=false in the context.xml
  but this does not fix the issue.</p>
  
  <p>It seems it might be related to the website supporting both https and http, and switching between the two (although it did occur on a website that did not support https as well...)</p>
  
  <p>Okay, I can now recreate the issue, steps are.</p>
  
  <ol>
  <li>connect to website via https</li>
  <li>logout / login</li>
  <li>connect to website via http</li>
  <li>Tomcat JSESSIONID cookie can no longer be stored (oddly user/password cookies are stored)</li>
  </ol>
  
  <p>This only happens on Chrome, and only since the Chrome update that add the "insecure" flag on login pages that use http</p>
  
  <p>Okay I added this to my web.xml</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;cookie-config&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;secure&gt;true&lt;/secure&gt;
      &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>This did not fix the issue, but made the issue always occur through http, i.e. make http no longer able to store the JSESSIONID cookie.
  I tried <code>&lt;secure&gt;false&lt;/secure&gt;</code> but still get the old issue.
  So, it is related to this setting at least. Anyone have any ideas?</p>
  
  <p>Logged bug on Chrome,
  <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=698741" rel="noreferrer">https://bugs.chromium.org/p/chromium/issues/detail?id=698741</a></p>