HttpOnly settings can be done in application having servlet api-2.5 and web.xml 2.5 version? <p>wanna enable httpOnly attribute to session cookie for our application. we are using servlet-api 2.5 version and web.xml as 2.5 .. now i have tried adding below code in web.xml </p> <pre><code>&lt;cookie-config&gt; &lt;http-only&gt;true&lt;/http-only&gt; &lt;/cookie-config&gt; </code></pre> <p>i got error parsing error in <code>web.xml</code> at <code>&lt;cookie-config&gt;</code></p> <p>can any please help on this.. do i need to update servlet version to 3 and web.xml to 3 as well ...</p> <p>or any other ways to do it writing in java code itself.. we are using jboss 5 version..</p>