we are implementing HttpOnly cookies in our portal and I am trying for different approaches
1. I have tried overwriting the SET-COOKIE http response header with a session cookie value to explicitly append the HttpOnly flag by setting in response header:
response.setHeader("SET-COOKIE", cookie.getName()+"=" + sessionid+ "; Path=" + contextPath + "; HttpOnly" + secure );
2. Trying with ESAPI#Java_EE library by adding cookie in SecurityWrapperResponse
securityWrapperResponse.addCookie(cookie);
Which is the best way of handling this security and why? Also when i tested the above implementation, JSESSIONID cookie is not set HttpOnly flag when context path is empty. And it works if context path has some valid path. Is this a correct way of testing the above implementation or i am doing something wrong? Please advise.
Thanks in advance.
