Why can't both HTTP Only and Secure flags be set in the cookies using Apache WebLogic?

Question

My architect tells me that when using Apache to Front-end WebLogic, WebLogic can't set the Secure flag in the cookies. Why is that?

We are using Apache to create FIPS 140-2 compliant HTTPS connections.

Update: The reason given is that "The cookie is set by WebLogic, not Apache, because it needs to tie back to a WebLogic session." Does WebLogic not support setting the Secure flag?

Answer 1

My architect got back to me.

"I stand corrected. It appears that this does work. I was lead to be believe that this could not be done in Apache, because Apache was the SSL endpoint, but not the creator of the cookie. However, it actually makes sense that this CAN be done."