Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

Question

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did:

Example that we had applied on weblogic.xml and faced session expiry issue.

  <param-name>CookieName</param-name>

  <param-value>I</param-value>

     </session-param>

        <cookie-secure >true</cookie-secure>

     <!--<cookie-http-only>true</cookie-http-only>-->

We implemented this line to ensure secure cookies:

<cookie-secure >true</cookie-secure>

However due to this, we are facing session expiry and I was looking for any alternate solution to come-by keeping cookies secure - is there any alternate solution for the secure cookie?

EDIT: We're using these below versions and other details. The initial answers provided did not support the documentation here.

Server info: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
Servlet version: 2.5
JSP version: 2.1
Java version: 1.6.0_05
Server

I needed a solution around this configuration.

Answer 1

I am not sure if I completely understood the issue, but here are my suggestions:

If the HTTPOnly Cookie flag is set then:

 {
 <session-config>
 <cookie-config>
 <http-only>true</http-only>
 </cookie-config>
 </session-config>
 }

If the session ID is transmitted in an URL parameter, try to dump it and see if there is there any counter running on it:

 {
 <session-config>
 <tracking-mode>COOKIE</tracking-mode>
 </session-config>
 }

Next, try to increase the expiration time and then try to migrate it securely. If it is not configured well you might be able to:

Increase the expiration time:

 {
 <session-config>
 <session-timeout>Time Period(In minutes)</session-timeout>
 </session-config>
 }

Please notify me if I understood the question incorrectly.