httpOnly flag not working using Apache mod_headers

Question

I've written this rule to add httpOnly flag to each cookie but the result was that.

What's wrong with the rule? Header edit Set-Cookie ^(.*)$ "$1;HttpOnly;Secure"

[EDIT] I've tried to do this treatment at backend, but it's using servlet 2.4 and jboss4. But the mininum required is servlet 3.0

I'd *highly* recommend reserving setting any kind of cookies to done with scripting languages, not Apache. Apache is updated a *lot* less frequently than even slowly evolving programming languages. That being said there might be a way to do it though I just can't recommend coming to rely on Apache for everything. — John, Jul 04 '20 at 03:59
which backend server are you using? This parameter is only recommended with SSL connector. — Pandurang, Jul 04 '20 at 09:10
@Pandurang I've edited the post. It's java6 but the problem is that servlet version is 2.4 — André Luís Oliveira, Jul 06 '20 at 12:47
@John I've tried do it at backend but servlet version was a barrier — André Luís Oliveira, Jul 06 '20 at 13:00
I program PHP, not Java though if the two are any alike instead of using PHP's `setcookie` function, specific to cookies, I would just use PHP's `header()` function instead. Surely Java has functions to let you completely define headers? — John, Jul 07 '20 at 00:40
@John Indeed there are, but Apache seemed easier, that's why I made efforts on it — André Luís Oliveira, Jul 07 '20 at 01:21

Pandurang · Answer 1 · 2020-07-10T05:11:30.003

0

Do you want to edit JSessionID header? If yes then you need to use the same Exact name in Header. i.e

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

edited Jul 10 '20 at 05:11

answered Jul 06 '20 at 13:50

Pandurang

I want that every cookie be flagged as httpOnly – André Luís Oliveira Jul 06 '20 at 16:39
You can refer https://stackoverflow.com/questions/29146465/how-to-configure-jboss-4-0-to-make-session-cookie-httponly-and-secure to configure JBoss 4.0.* to make session cookie HttpOnly and secure. – Pandurang Jul 06 '20 at 16:43
I've tried to modify XML file ate Jboss4, no success – André Luís Oliveira Jul 06 '20 at 18:14
For which cookie you want to set HttpOnly? JessionId or any other? JBoss generates a default JSessionID cookie. are you generating cookie in code? If yes then you need to add httponly at the code level – Pandurang Jul 07 '20 at 00:33
for all cookies. But I'd rather to know why Apache strategy didn't work – André Luís Oliveira Jul 07 '20 at 01:20
Could you please use always and test. i.e `Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure` – Pandurang Jul 10 '20 at 05:12

1 Answers1