java - How do I set the HttpOnly flag on JSF/Richfaces

Question

I'd like to add the HttpOnly flag to JSF/richfaces cookies, especially the session cookie, to up the level of security on my web app. Any ideas?

Answer 1

FacesContext facesContext = FacesContext.getCurrentInstance().getFacesContext();

HttpServletResponse response = (HttpServletResponse) facesContext.getExternalContext().getResponse();

response.addHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");

Answer 2

可能有一些东西允许您在 servlet 引擎中执行此操作。这是尚未发布的 Servlet 3.0 规范的一部分。

Answer 3

Something like:

response.setHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");

might work in a Java environment. I am not aware of a JSF-specific way to achieve this... sorry

This seems to be not an easy task in Java.

Answer 4

I suspect that I'll need to use a filter to add a response wrapper, which'll add the flag to all cookies as they're added by the framework.