title: How do you configure HttpOnly cookies in tomcat / java webapps?
body: <p>After reading Jeff's blog post on <a href="http://www.codinghorror.com/blog/archives/001167.html" rel="noreferrer">Protecting Your Cookies: HttpOnly</a>. I'd like to implement HttpOnly cookies in my web application.</p>
  
  <p>How do you tell tomcat to use http only cookies for sessions?</p>