How do you configure HttpOnly cookies in tomcat / java webapps?

There are several methods to configure HttpOnly cookies in Tomcat. The following will be explained step by step, with specific configuration steps and examples.

1. Global Configuration in web.xml

To enhance the security of web applications, configure the deployment descriptor file web.xml to set all cookies as HttpOnly by default.

Steps:

1. Open the web.xml file in the WEB-INF folder of the web application.
2. Add the <session-config> tag; if it already exists, add <cookie-config> inside it.

Example:

xml
<web-app ...>
    ...
    <session-config>
        <cookie-config>
            <http-only>true</http-only>
        </cookie-config>
    </session-config>
    ...
</web-app>

After this configuration, all web applications deployed on this Tomcat server will have their Session ID cookies and other cookies automatically marked with HttpOnly, enhancing cookie security.

2. Context-Level Configuration

If you only want to configure a specific application without affecting others, set it in the application's context.xml file.

Steps:

1. Locate or create the META-INF/context.xml file for the application.
2. Add or modify the useHttpOnly attribute of the <Context> tag.

Example:

xml
<Context useHttpOnly="true">
    ...
</Context>

After this configuration, only the specific application will use the HttpOnly attribute, while other applications remain unaffected.

3. Explicitly Setting HttpOnly in Code

When developing the application, you can explicitly set the HttpOnly attribute for cookies in the code.

Java Code Example:

java
Cookie cookie = new Cookie("user", "username");
cookie.setHttpOnly(true);
response.addCookie(cookie);

This approach allows flexible control over which cookies require the HttpOnly attribute, suitable for fine-grained security management.

Conclusion

The above are the three main methods to configure HttpOnly cookies in Tomcat. Depending on the application's requirements and deployment environment, choose the most suitable method to enhance cookie security. In practice, it is recommended to configure at the global level (in web.xml) or at the Context level (in context.xml) for easier management and maintenance. Additionally, when writing code, you can fine-tune individual cookies as needed.