How to configure for session cookie as http-only

Question

to set http-only I used this in web.xml

<session-config>
        <cookie-config>
        <http-only>true</http-only>
        </cookie-config>
    </session-config>

but it is not setting http-only. can any one suggest, what may be the problem. and how to set it.

Thanks.

Answer 1

Which container are you using and in which version? pay attention since true can be used in web.xml only since servlet 3.0