title: Cookie http only with spring security and servlet 2.5?
body: <p>I want to make my cookie secure and http request only.</p>
  
  <p>Ive seen many post like <a href="https://stackoverflow.com/questions/23977304/java-httponly-flag">this</a> and seem to work fine, but using configuration files and servlet +3.</p>
  
  <p>What I basically want to do is to set my cookie http only and (if possible) ssl only as well.</p>
  
  <p>So far I added this to my web.xml</p>
  
  <pre><code>    &lt;session-config&gt;
          &lt;session-timeout&gt;60&lt;/session-timeout&gt;
          &lt;cookie-config&gt;
              &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;/cookie-config&gt;
          &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
      &lt;/session-config&gt;
  </code></pre>
  
  <p>doesnt do anything, as far as I was reading, I also have to configure my servlet.xml to enable this feature, but I dont know how... </p>
  
  <p>Any idea how to do this?</p>
  
  <p>EDIT:</p>
  
  <p>Since I am using servlets 2.5 the xml configuration is not an option, maybe a filter? </p>