當會話Cookie中不含有HttpOnly屬性和secure屬性時，注入站點的惡意指令碼可能訪問此Cookie，並竊取它的值。任何儲存在會話令牌中的資訊都可能被竊取，並在稍後用於身份盜竊或使用者偽裝。

基本上，cookie 的唯一必需屬性是“name”欄位,必須設定“HttpOnly”屬性，才能防止會話 cookie 被指令碼訪問。

解決方法：設立一個過濾器修改每次會話，為之新增”HostOnly”屬性和“secure”屬性。

package ...
public class ExampleFilter implements Filter {

    public void doFilter
 
(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;  
        HttpServletResponse resp = (HttpServletResponse) response; 
        Cookie[] cookies = req.getCookies();

        if
 
(tomcat版本>=7) {
            for(Cookie cookie : cookies) {
                cookie.setHttpOnly(true);
                cookie.setSecure(true);
            }
        } else if(tomcat版本<=6) {
            for(Cookie cookie : cookies) {
                String value = cookie.getValue();  
                StringBuilder builder = new
 
 StringBuilder();  
                builder.append("JSESSIONID=" + value + "; ");  
                builder.append("Secure; ");  
                builder.append("HttpOnly; ");  
                Calendar cal = Calendar.getInstance();  
                cal.add(Calendar.HOUR, 1);  
                Date date = cal.getTime();  
                Locale locale = Locale.CHINA;  
                SimpleDateFormat sdf = new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale); 
                builder.append("Expires=" + sdf.format(date));  
                resp.setHeader("Set-Cookie", builder.toString()); 
            }
        }
        chain.doFilter(request,response);
    }
}