Cookie http only with spring security and servlet 2.5?
<p>I want to make my cookie secure and http request only.</p>

<p>Ive seen many post like <a href="https://stackoverflow.com/questions/23977304/java-httponly-flag">this</a> and seem to work fine, but using configuration files and servlet +3.</p>

<p>What I basically want to do is to set my cookie http only and (if possible) ssl only as well.</p>

<p>So far I added this to my web.xml</p>

<pre><code>    &lt;session-config&gt;
        &lt;session-timeout&gt;60&lt;/session-timeout&gt;
        &lt;cookie-config&gt;
            &lt;http-only&gt;true&lt;/http-only&gt;
        &lt;/cookie-config&gt;
        &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
    &lt;/session-config&gt;
</code></pre>

<p>doesnt do anything, as far as I was reading, I also have to configure my servlet.xml to enable this feature, but I dont know how... </p>

<p>Any idea how to do this?</p>

<p>EDIT:</p>

<p>Since I am using servlets 2.5 the xml configuration is not an option, maybe a filter? </p>