title: How to change jsessionid cookie path to server root in Spring app on Jetty?
body: <p>I have a Jetty server running a Spring app on the <code>/app</code> context. The app uses sessions, so it sets a session cookie, which responds like this:</p>
  <pre><code>set-cookie:JSESSIONID=679b6291-d1cc-47be-bbf6-7ec75214f4e5; Path=/app; HttpOnly
  </code></pre>
  <p>I need that cookie to have a path of <code>/</code> instead of the webapp's context. Plus I want to use secure cookies. I want this response:</p>
  <pre><code>set-cookie:JSESSIONID=679b6291-d1cc-47be-bbf6-7ec75214f4e5; Path=/; HttpOnly; Secure
  </code></pre>
  <p>Where is the proper place to configure the session cookie? Does spring help with this? Should it be in <code>web.xml</code>? Or do I need to configure it in a container specific way, such as <code>jetty-web.xml</code>?</p>
  <p>I've tried a bunch of things, but nothing has worked so far. Below are some things I tried.</p>
  <hr />
  <h2>Attempt #1</h2>
  <p>Created <code>WEB-INF/jetty-web.xml</code> with the following:</p>
  <pre><code>&lt;Configure class=&quot;org.eclipse.jetty.webapp.WebAppContext&quot;&gt;
      &lt;Get name=&quot;sessionHandler&quot;&gt;
        &lt;Get name=&quot;sessionManager&quot;&gt;
          &lt;Set name=&quot;sessionCookie&quot;&gt;MYJETTYSESSION&lt;/Set&gt;
          &lt;Set name=&quot;sessionPath&quot;&gt;/&lt;/Set&gt;
          &lt;Set name=&quot;secureCookies&quot; type=&quot;boolean&quot;&gt;true&lt;/Set&gt;
          &lt;Set name=&quot;httpOnly&quot; type=&quot;boolean&quot;&gt;true&lt;/Set&gt;
        &lt;/Get&gt;
      &lt;/Get&gt;
  &lt;/Configure&gt;
  </code></pre>
  <p>This causes an exception to be thrown:</p>
  <pre><code>2012-10-05 02:41:41.180:WARN:oejx.XmlConfiguration:Config error at &lt;Set name=&quot;sessionPath&quot;&gt;/&lt;/Set&gt; java.lang.NoSuchMethodException: class org.eclipse.jetty.server.session.HashSessionManager.setSessionPath(class java.lang.String)
  2012-10-05 02:41:41.180:WARN:oejx.XmlConfiguration:Config error at &lt;Get name=&quot;sessionManager&quot;&gt;&lt;Set name=&quot;sessionCookie&quot;&gt;MYJETTYSESSION&lt;/Set&gt;&lt;Set name=&quot;sessionPath&quot;&gt;/&lt;/Set&gt;&lt;Set name=&quot;secureCookies&quot;&gt;true&lt;/Set&gt;&lt;Set name=&quot;httpOnly&quot;&gt;true&lt;/Set&gt;&lt;/Get&gt; java.lang.NoSuchMethodException: class org.eclipse.jetty.server.session.HashSessionManager.setSessionPath(class java.lang.String)
  2012-10-05 02:41:41.180:WARN:oejx.XmlConfiguration:Config error at &lt;Get name=&quot;sessionHandler&quot;&gt;&lt;Get name=&quot;sessionManager&quot;&gt;&lt;Set name=&quot;sessionCookie&quot;&gt;MYJETTYSESSION&lt;/Set&gt;&lt;Set name=&quot;sessionPath&quot;&gt;/&lt;/Set&gt;&lt;Set name=&quot;secureCookies&quot;&gt;true&lt;/Set&gt;&lt;Set name=&quot;httpOnly&quot;&gt;true&lt;/Set&gt;&lt;/Get&gt;&lt;/Get&gt; java.lang.NoSuchMethodException: class 
  </code></pre>
  <p>The full stack trace is in <a href="https://gist.github.com/3843133" rel="noreferrer">this gist</a>.</p>
  <h2>Attempt #2</h2>
  <p>Created <code>WEB-INF/jetty-web.xml</code> with the following:</p>
  <pre><code>&lt;Configure class=&quot;org.eclipse.jetty.webapp.WebAppContext&quot;&gt;
      &lt;Call name=&quot;setInitParameter&quot;&gt;
          &lt;Arg&gt;org.eclipse.jetty.servlet.SessionCookie&lt;/Arg&gt;
          &lt;Arg&gt;MYSESSIONID&lt;/Arg&gt;
      &lt;/Call&gt;
      &lt;Call name=&quot;setInitParameter&quot;&gt;
          &lt;Arg&gt;org.eclipse.jetty.servlet.SessionIdPathParameterName&lt;/Arg&gt;
          &lt;Arg&gt;mysessionid&lt;/Arg&gt;
      &lt;/Call&gt;
      &lt;Call name=&quot;setInitParameter&quot;&gt;
          &lt;Arg&gt;org.eclipse.jetty.servlet.SessionPath&lt;/Arg&gt;
          &lt;Arg&gt;/&lt;/Arg&gt;
      &lt;/Call&gt;
  &lt;/Configure&gt;
  </code></pre>
  <p>This does not cause any exception, but the cookie is still <code>JSESSIONID</code> and contains the webapp context path <code>/app</code>.</p>
  <h2>Attempt #3</h2>
  <p>Updated <code>WEB-INF/web.xml</code> with the following:</p>
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;org.eclipse.jetty.servlet.SessionPath&lt;/param-name&gt;
      &lt;param-value&gt;/&lt;/param-value&gt;
  &lt;/context-param&gt;
  &lt;context-param&gt;
      &lt;param-name&gt;org.eclipse.jetty.servlet.SessionCookie&lt;/param-name&gt;
      &lt;param-value&gt;MYSESS&lt;/param-value&gt;
  &lt;/context-param&gt;
  </code></pre>
  <p>This does not cause any exception, but the cookie is still <code>JSESSIONID</code> and contains the webapp context path <code>/app</code>.</p>
  <h2>Attempt #4</h2>
  <p>Updated <code>WEB-INF/web.xml</code> with the following:</p>
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;720&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;name&gt;SZSESSION&lt;/name&gt;
          &lt;path&gt;/&lt;/path&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;secure&gt;true&lt;/secure&gt;
      &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  <p>This does not cause any exception, but the cookie is still <code>JSESSIONID</code> and contains the webapp context path <code>/app</code>.</p>
  <h2>Maven configuration</h2>
  <p>Note that I'm using Jetty Maven Plugin version 8.1.5.v20120716 and doing a <code>mvn jetty:run</code>:</p>
  <pre><code>&lt;jetty.maven.plugin.version&gt;8.1.5.v20120716&lt;/jetty.maven.plugin.version&gt;
  &lt;spring.version&gt;3.0.0.RELEASE&lt;/spring.version&gt;
    ...
  &lt;plugin&gt;
      &lt;groupId&gt;org.mortbay.jetty&lt;/groupId&gt;
      &lt;artifactId&gt;jetty-maven-plugin&lt;/artifactId&gt;
      &lt;version&gt;${jetty.maven.plugin.version}&lt;/version&gt;
      &lt;configuration&gt;
          &lt;scanIntervalSeconds&gt;10&lt;/scanIntervalSeconds&gt;
          &lt;reload&gt;manual&lt;/reload&gt;
          &lt;stopPort&gt;${jetty.stop.port}&lt;/stopPort&gt;
          &lt;stopKey&gt;foo&lt;/stopKey&gt;
          &lt;webAppConfig&gt;
                &lt;contextPath&gt;/app&lt;/contextPath&gt;
          &lt;/webAppConfig&gt;
      &lt;/configuration&gt;
         ...
  &lt;/plugin&gt;
  </code></pre>