From 44cbb23430cb9eb0cdbbd1452208d25e1b454711 Mon Sep 17 00:00:00 2001
From: Ron Straight <ron.straight@synacor.com>
Date: Mon, 29 Aug 2022 11:13:39 -0400
Subject: [PATCH] ZBUG-2341: Flag JSESSIONID httpOnly and secure

---
 conf/jetty/webdefault.xml            | 5 +++++
 conf/jetty/webdefault.xml.production | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/conf/jetty/webdefault.xml b/conf/jetty/webdefault.xml
index a4b1fa8..04d6374 100644
--- a/conf/jetty/webdefault.xml
+++ b/conf/jetty/webdefault.xml
@@ -354,8 +354,13 @@
 
 
   <!-- ==================================================================== -->
+
   <session-config>
     <session-timeout>5</session-timeout>
+    <cookie-config>
+      <http-only>true</http-only>
+      <secure>true</secure>
+    </cookie-config>
   </session-config>
 
   <!-- ==================================================================== -->
diff --git a/conf/jetty/webdefault.xml.production b/conf/jetty/webdefault.xml.production
index 722b046..b64e748 100644
--- a/conf/jetty/webdefault.xml.production
+++ b/conf/jetty/webdefault.xml.production
@@ -370,8 +370,13 @@
 
 
   <!-- ==================================================================== -->
+
   <session-config>
     <session-timeout>5</session-timeout>
+    <cookie-config>
+      <http-only>true</http-only>
+      <secure>true</secure>
+    </cookie-config>
   </session-config>
 
   <!-- ==================================================================== -->