title: adding httponly and secure flag for set cookie in java web application
body: <p>I want to add the <code>httponly</code> and <code>secure</code> flags for Cookies. To implement it, I am using <code>Filters</code> which  are configured in <code>web.xml</code>.</p>
  
  <p>The code for adding flags is as below:</p>
  
  <pre><code>package com.crisil.dbconn;
  
  import java.io.IOException;
  
  import javax.servlet.Filter;
  import javax.servlet.FilterChain;
  import javax.servlet.FilterConfig;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.Cookie;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  import org.apache.struts2.ServletActionContext;
  import org.owasp.esapi.ESAPI;
  import org.owasp.esapi.filters.SecurityWrapperResponse;
  
  public class ClickjackFilter implements Filter 
  {
  
      private String mode = "DENY";
  
      /**
       * Add X-FRAME-OPTIONS response header to tell IE8 (and any other browsers who
       * decide to implement) not to display this content in a frame. For details, please
       * refer to http://blogs.msdn.com/sdl/archive/2009/02/05/clickjacking-defense-in-ie8.aspx.
       */
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse res = (HttpServletResponse)response;
          //HttpServletRequest req = (HttpServletRequest)request.getSession();
  
  
          res.addHeader("X-FRAME-OPTIONS", mode );
          res.addHeader("X-Content-Type-OPTIONS", "nosniff" );
          res.addHeader("X-XSS-Protection", "1; mode=block" );
          res.addHeader("Vary", "*" );
          res.addHeader("Expires", "-1" );
          res.addHeader("Pragma", "no-cache" );
          res.addHeader("Cache-control", "no-cache, no-store,max-age=0, must-revalidate" );
          String contextPath = ((HttpServletRequest) request).getContextPath()+"kevalcccc";
         ((HttpServletResponse)ServletActionContext.getResponse()).setHeader("SET-COOKIE",  "JSESSIONID=" + ((HttpServletRequest)request).getSession().getId() + ";Path="+contextPath+";Secure;HttpOnly");
       // touch the session
         // ((HttpServletRequest) request).getSessison();
         // System.out.println("zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz");
  
          // overwriting the cookie with Secure attribute set
         // ((HttpServletResponse)response).setHeader("Set-Cookie", "JSESSIONID=" + ((HttpServletRequest)request).getSession().getId() + ";Path=/");
  
          ////////////
  
         /* Cookie[] cookies = ((HttpServletRequest) request).getCookies();
          if (cookies != null)
              for (int i = 0; i &lt; cookies.length; i++) {
                  cookies[i].setValue("");
                  cookies[i].setPath("/");
                  cookies[i].setMaxAge(0);
                  cookies[i].setSecure(true);
                  res.addCookie(cookies[i]);
              }
          */
          //////////////
          String sessionid = ((HttpServletRequest) request).getSession().getId();
          ((HttpServletResponse) response).setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");
  
          chain.doFilter(request, response);
      }
  
      public void destroy() {
      }
  
      public void init(FilterConfig filterConfig) {
          String configMode = filterConfig.getInitParameter("mode");
          if ( configMode != null ) {
              mode = configMode;
          }
      }
  
  }
  </code></pre>
  
  <p>The above code is adding <code>httponly</code> and <code>secure</code> flags for the JSESSIONID cookie.  However, in the Response Header, I am getting two cookies.  The second one does not have <code>httponly</code> and <code>secure</code> flags set.  Please refer to the below output:</p>
  
  <blockquote>
    <p>JSESSIONID=1dbLWQ6WYBHJ93Tv7TfQ2fdLgjRp2pQBsVxQVZ2WBQkYwB60wg43!1248935162!1451244054765;
    HttpOnly;Secure </p>
    
    <p>JSESSIONID=1dbLWQ6WYBHJ93Tv7TfQ2fdLgjRp2pQBsVxQVZ2WBQkYwB60wg43!1248935162;
    path=/"</p>
  </blockquote>
  
  <p>Why are the <code>httponly</code> and <code>secure</code> flags not added for the second cookie?</p>