Improved: Add session tracking mode and make cookie secure
In CrossSubdomainSessionValve::replaceCookie sets HttpOnly if it was in replaced
cookie
@@ -102,6 +102,7 @@ public class CrossSubdomainSessionValve extends ValveBase {
newCookie.setComment(cookie.getComment());
}
newCookie.setSecure(cookie.getSecure());
+ newCookie.setHttpOnly(cookie.isHttpOnly());
// if the response has already been committed, our replacement strategy will have no effect
if (response.isCommitted()) {
