title: httpOnly Session Cookie + Servlet 3.0 (e.g. Glassfish v3)
body: <p>By default, Glassfish v3 doesn't set the httpOnly flag on session cookies (when created as usual with <code>request.getSession()</code>).</p>
  
  <p>I know, there is a method <code>javax.servlet.SessionCookieConfig.setHttpOnly()</code>, but I'm not sure, if that's the best way to do it, and if yes, where the best place would be to put that line.</p>
  
  <p>BTW, of course it <em>can't</em> be done in the servlet itself (e.g. in init()):</p>
  
  <pre><code>java.lang.IllegalStateException: PWC1426: 
  Unable to configure httpOnly session tracking cookie property for 
  servlet context /..., because this servlet context has already been initialized
  </code></pre>
  
  <hr>
  
  <p>Generally, I would prefer to use a configuration option e.g. in web.xml.</p>