HttpOnly 속성 거는 방법

Tomcat에서 걸때

<Context path="/myWebApplicationPath" useHttpOnly="true">

Java에서 걸때

String sessionid = request.getSession().getId();

// be careful overwriting: JSESSIONID may have been set with other flags

response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");

web.xml에서 걸때

<session-config>

 <cookie-config>

  <http-only>true</http-only>

 </cookie-config>

</session-config>

더 자세한 정보는 https://www.owasp.org/index.php/HttpOnly 참고