Cookie

• HTTP Cookie
• HTTPOnly

• web.xml 설정으로 세션 쿠키를 HTTPOnly로 설정

  <session-config>
   <cookie-config>
    <http-only>true</http-only>
   </cookie-config>
  <session-config>

• Cookie#setHttpOnly

response.setHeader( "Set-Cookie", "name=value; HttpOnly");

• security - How do you configure HttpOnly cookies in tomcat / java webapps?
• httpOnly is supported as of Tomcat 6.0.19 and Tomcat 5.5.28.

  <Context useHttpOnly="true">
  ...
  </Context>