title: How to make all cookies (even non-JSESSIONID cookies) be "http-only"?
body: <p>I can set our custom cookies in Java to be &quot;secure&quot; using myCookie.setSecure(true). However, there's no method for setting cookies to be HttpOnly. A customer has requested that all our cookies, not just JSESSIONID, be Secure AND HttpOnly.</p>
  <p>We are using a WildFly server and Java to create these custom cookies.</p>
  <p><a href="https://i.stack.imgur.com/0aDXB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0aDXB.png" alt="enter image description here" /></a></p>