Setting the Session Secure Only Flag Programmatically
<p>In web.xml, you can make sure that the session cookie (JSESSIONID) is set as an SSL only cookie by the following: </p>

<pre><code>&lt;session-config&gt;
  &lt;cookie-config&gt;
    &lt;secure&gt;true&lt;/secure&gt;
  &lt;/cookie-config&gt;
&lt;/session-config&gt;
</code></pre>

<p>Is there a way to achieve the same thing programmatically when you create the session? </p>
