To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did:
Example that we had applied on weblogic.xml and faced session expiry issue.
<param-name>CookieName</param-name> <param-value>I</param-value> </session-param> <cookie-secure >true</cookie-secure> <!--<cookie-http-only>true</cookie-http-only>-->
We implemented this line to ensure secure cookies:
However due to this, we are facing session expiry and I was looking for any alternate solution to come-by keeping cookies secure - is there any alternate solution for the secure cookie?
EDIT: We're using these below versions and other details. The initial answers provided did not support the documentation here.
Server info: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967 Servlet version: 2.5 JSP version: 2.1 Java version: 1.6.0_05 Server
I needed a solution around this configuration.