Why can't both HTTP Only and Secure flags be set in the cookies using Apache WebLogic?

StackOverflow https://stackoverflow.com/questions/20074214

  •  31-07-2022
  •  | 
  •  

Question

My architect tells me that when using Apache to Front-end WebLogic, WebLogic can't set the Secure flag in the cookies. Why is that?

We are using Apache to create FIPS 140-2 compliant HTTPS connections.

Update: The reason given is that "The cookie is set by WebLogic, not Apache, because it needs to tie back to a WebLogic session." Does WebLogic not support setting the Secure flag?

Was it helpful?

Solution

My architect got back to me.

"I stand corrected. It appears that this does work. I was lead to be believe that this could not be done in Apache, because Apache was the SSL endpoint, but not the creator of the cookie. However, it actually makes sense that this CAN be done."

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top