在web.xml中加入攔截器：

<!-- Cookie中設定HttpOnly屬性為true -->
    <filter>
    	<filter-name>CookieFilter</filter-name>
    	<filter-class>com.zfsoft.filter.CookieFilter</filter-class>
    </filter>
    <filter-mapping>
    	<filter-name>CookieFilter</filter-name>
    	<url-pattern>/*</url-pattern>
    </filter-mapping>
 

CookieFilter.java內容如下：

/**
 * 向所有會話cookie中新增“HttpOnly”屬性
 * @author dyq
 * @date 20180628
 *
 */
public class CookieHttpOnlyFilter implements Filter{

	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		HttpServletRequest Hrequest = (HttpServletRequest)request;
	    Cookie[] cookies=Hrequest.getCookies();
	    for(Cookie cookie:cookies){
	    	/**
	    	 * //tomcat7 支援該屬性，tomcat6不支援
	    	 * //cookie.setHttpOnly(true);
	    	 */
	    	//tomcat6
	    	  String value = cookie.getValue();  
              StringBuilder builder = new StringBuilder();  
              builder.append("JSESSIONID=" + value + "; ");  
              builder.append("Secure; ");  
              builder.append("HttpOnly; ");  
              Calendar cal = Calendar.getInstance();  
              cal.add(Calendar.HOUR, 1);  
              Date date = cal.getTime();  
              Locale locale = Locale.CHINA;  
              SimpleDateFormat sdf = new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale); 
              builder.append("Expires=" + sdf.format(date));  
              resp.setHeader("Set-Cookie", builder.toString()); 
	    	
	    }
	    chain.doFilter(new StrutsRequestWrapper((HttpServletRequest) request), response); 
	}

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

}