Have Geek Brain

HttpOnly cookies in Google App Engine java

Does anyone know how I can use httponly cookies for sessions and cookies in the application engine?

In the javadoc for the Cookie class http://java.sun.com/javaee/6/docs/api/javax/servlet/http/Cookie.html#setHttpOnly(boolean) there is a setHttpOnly method.

I am getting a compiler error when trying to use it while developing for an application engine.

The method was introduced in the Servlet 3.0 specification, so its quite new.

+2


a source to share


2 answers


App Engine supports the Servlet API in version 2.5, so you cannot use the setHttpOnly method.

You can try to infer the cookie header yourself.



resp.setHeader("Set-Cookie", "A=7; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/; domain=.example.net; HttpOnly");
+3


a source


Since 2017 GAE supports Servlet API 3.1 So I tested the following cookie version inside web.xml and it works:



<session-config>
  <cookie-config>
    <http-only>true</http-only>
  </cookie-config>
</session-config>
0


a source






More articles:


All Articles