title: set httpOnly and secure flags on session cookie in Google App Engine
body: <p>I need to set httpOnly and secure flags on session cookie in Google App Engine.</p>
  
  <p>I tried the following in <code>web.xml</code>:</p>
  
  <pre><code>&lt;session-config&gt;
   &lt;cookie-config&gt;
    &lt;http-only&gt;true&lt;/http-only&gt;
   &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>However, this didn't work.</p>
  
  <p>I also tried this in the top of every JSP:</p>
  
  <pre><code>String sessionid = request.getSession().getId();
  response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");
  </code></pre>
  
  <p>How can I achieve this?</p>