title: How can I create HttpOnly cookies using Servlet API 2.5?
body: <p>I'm working with a web application that uses Servlet API v2.5, running on Tomcat 6, and I need to send HttpOnly cookies to the client. I'm <strong>not</strong> talking about session cookies generated by the servlet container (which is covered excellently by <a href="https://stackoverflow.com/questions/33412/how-do-you-configure-httponly-cookies-in-tomcat-java-webapps">this question</a>), but custom cookies added to the response using <code>response.addCookie()</code>.</p>
  <p>The <code>Cookie#setHttpOnly()</code> method does not exist in v2.5, so I have to build the HTTP header myself and add the <code>HttpOnly</code> token. Is there an easy way to do this without rolling my own implementation of <a href="https://www.rfc-editor.org/rfc/rfc6265#section-4.1" rel="nofollow noreferrer">RFC 6265</a> from scratch?</p>