How to set httponly and session cookie for java web application

Ensuring the security of web applications is a crucial part of the development process, especially when handling cookies. Setting HttpOnly and session cookies can effectively enhance application security. The following are the steps and considerations for setting HttpOnly and session cookies in Java Web applications:

1. Using Servlet API to Set HttpOnly Cookies

In Java, you can use the javax.servlet.http.Cookie object to create and modify cookies. To set the HttpOnly attribute, you can use the setHttpOnly(boolean isHttpOnly) method. This method is available in Servlet 3.0 and later versions. Here is a simple example:

java
// Create a new Cookie
Cookie myCookie = new Cookie("sessionId", sessionValue);
// Set maximum age to 60 minutes
myCookie.setMaxAge(60 * 60);
// Set HttpOnly to true, preventing JavaScript from accessing this cookie
myCookie.setHttpOnly(true);
// Add the cookie to the response
response.addCookie(myCookie);

2. Setting Session Cookies

Session cookies are not persisted on the client side; they are only valid during the current browser session and are deleted when the browser is closed. Setting session cookies does not require setting an expiration time, or you can explicitly set it to -1.

java
// Create a session cookie
Cookie sessionCookie = new Cookie("sessionKey", "sessionValue");
// Set maximum age to -1 (optional, as the default behavior is session-based)
sessionCookie.setMaxAge(-1);
// Also set HttpOnly
sessionCookie.setHttpOnly(true);
// Add the cookie to the response
response.addCookie(sessionCookie);

3. Globally Setting HttpOnly and Session Cookies in the Web Container (e.g., in Tomcat)

In some cases, you may want to set the HttpOnly attribute at the server level to ensure all cookies automatically apply this security measure. In the Tomcat container, you can modify the $CATALINA_BASE/conf/context.xml file and add the <CookieProcessor> element:

xml
<Context>
    ...
    <CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"
                     httpOnlyCookies="true" />
    ...
</Context>

After this configuration, all cookies created by this Tomcat instance will automatically be set to HttpOnly.

4. Considering Security Best Practices

In addition to setting HttpOnly and session cookies, you should also consider the following security best practices:

• Use the Secure flag to ensure cookies are transmitted only over HTTPS.
• Set the scope and path of cookies appropriately.
• Regularly review and update security configurations.

Summary

By following the above steps, you can effectively set HttpOnly and session cookies in Java Web applications to enhance application security. These measures help prevent cross-site scripting (XSS) attacks and session hijacking.