Adding secure and httponly attributes to JSESSIONID cookie

[#1]

Hi All,

We have used session from request to store few data. When we access the session, it generates JSESSIONID cookie. But the generated JSESSIONID cookie does not have cookie attributes "secure" and "httponly".

Can anyone please provide me pointers on how to add these flags to the JSESSIONID cookie in AEM.

Thanks in advance,

Amuthesan

[#2]

See Sham's answer here: http://help-forums.adobe.com/content/adobeforums/en/experience-manager-forum/adobe-experience-manage...

[#3]

Hi Scott,

Thanks for the reply. 

We are currently offloading the SSL at the dispatcher level and the communication with AEM is non SSL. And also if we enable the SSL for the AEM, all the cookies would be made secure and httponly, we do not want that. We want only the JSESSIONID cookie to be made secure. As we understand the cookie is created and managed by container, Is there any configuration/input that can be made to the container to create the cookie with the secure and httponly.

Thanks,

Amuthesan

[#4]

Did you find a solution to this?