title: atg-weblogic: Making JSESSIONID secure
body: <p>I am using weblogic 10.3.6 with ATG 10.1.2</p>
  
  <p>I want to make my JSESSIONID secure, I tried setting the weblogic.xml as follows, </p>
  
  <pre><code>&lt;session-descriptor&gt;
      &lt;cookie-name&gt;JSESSIONID&lt;/cookie-name&gt;
      &lt;timeout-secs&gt;1200&lt;/timeout-secs&gt;
      &lt;cookie-secure&gt;true&lt;/cookie-secure&gt;
      &lt;url-rewriting-enabled&gt;false&lt;/url-rewriting-enabled&gt;
  &lt;/session-descriptor&gt;
  </code></pre>
  
  <p>I tried turning the auth-coookie-enabled to false, to see if it then honors the cookie-secure from weblogic.xml, but it doesn't.</p>
  
  <pre><code>&lt;web-app-container&gt;
      &lt;x-powered-by-header-level&gt;SHORT&lt;/x-powered-by-header-level&gt;
      &lt;auth-cookie-enabled&gt;false&lt;/auth-cookie-enabled&gt;
    &lt;/web-app-container&gt;
  </code></pre>
  
  <p>spakred guys have posted a similar post earlier (<a href="https://www.sparkred.com/blog/how-to-fix-httponly-vulnerability-in-oracle-atg-commerce-applications/#comment-61577" rel="nofollow">httpOnly vulnerability fix</a>), where they have highlighted the runAssembler command issue, the solution provided there also doesn't work with weblogic, <em>(have left a comment there)</em>. Weblogic doesn't even check the context.xml <em>(I tried putting an invalid XML, no errors on start up)</em></p>
  
  <p>I have also noticed that if I change the cookie-name in weblogic.xml to another name, a JSESSIONID is still generated, and the new cookie becomes secure.<br> <br> 
  - Is there something else generating this cookie?<br>
  - Why isn't weblogic able to secure the JSESSIONID or even change its path <em>(changing cookie-path results in two JESSIONID cookies being sent)</em>?</p>
  
  <p>Has anyone tried this earlier, Please share your thoughts.</p>