httpOnly cookies

src/main/resources/spring/spring.properties

@@ -19,7 +19,7 @@ base.hostname=${base.host}:8080
 base.url=http://${base.hostname}
 base.cookie-domain=
 base.cookie-secure=false
-base.cookie-http-only=false
+base.cookie-http-only=true
 
 # robots.txt
 robots.allow=false

src/main/webapp/WEB-INF/web.xml

@@ -320,4 +320,9 @@
 	        <page-encoding>UTF-8</page-encoding>
 	    </jsp-property-group>
 	</jsp-config>
+	<session-config>
+		<cookie-config>
+			<http-only>true</http-only>
+		</cookie-config>
+	</session-config>
 </web-app>