title: Setting the Session Secure Only Flag Programmatically
body: <p>In web.xml, you can make sure that the session cookie (JSESSIONID) is set as an SSL only cookie by the following: </p>
  
  <pre><code>&lt;session-config&gt;
    &lt;cookie-config&gt;
      &lt;secure&gt;true&lt;/secure&gt;
    &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>Is there a way to achieve the same thing programmatically when you create the session? </p>