title: how to set httponly and session cookie for java web application
body: <p>I am working on an XSS (cross site scripting) issue.  My application runs on an Oracle Weblogic portal.  We use Servlet version 2.5.</p>
  
  <p>I have added the below 3 lines of code in the filter for setting httponly and secure cookies,
  and it is working fine.</p>
  
  <pre><code>String sessionid = req.getSession().getId();
  res.setHeader("Set-Cookie", "JSESSIONID=" +  sessionid + ";HttpOnly");
  res.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; secure");
  </code></pre>
  
  <p>The issue is when I logout and login immediately in the same browser.  I am able to login, but after that, on the jsp pages I am getting a session timeout issue.  We use weblogic related apis.  The <code>request.getuserprinical()</code> api is returning null..  guess it is setting to null.</p>
  
  <p>Please share any ideas.</p>
  
  <p>If there are any other ways to set httponly or secure flag, please help.</p>