Is the servlet cookie set safe?

Question

javax.servlet.http.Cookie implements java.lang.Cloneable 

There is a setSecure call method in the Cookie method, what is it used for? if I setSecure (true), is there anything I need to do on my client side (javascript) to read the cookie? what else is set / without setSecure?

Answer 1

All that setSecure(true) tells the browser that a cookie should be sent back to the server only when using a "secure" protocol like https . Your JavaScript code should not do anything else.

Answer 2

This ensures that your cookie session is not visible to the attacker like a man-in-the-middle attack. Instead of installing it manually , you can alternatively configure your web.xml to process it automatically for you.

 <session-config> <cookie-config> <secure>true</secure> </cookie-config> </session-config>