How do I update the cookie JSESSIONID with HttpOnly by working directly on Http Headers?
**Here is the big picture**

I want to append "HttpOnly" to the JSESSIONID Cookie, but I want to do this by hand, meaning:

    //create a new cookie
    StringBuilder updatedCookie = new StringBuilder("JSESSIONID").append("=")
    				.append(sessionId).append("; Path=").append("/")
    				.append("; HttpOnly");

    //save the cookie
    response.setHeader("SET-COOKIE", updatedCookie.toString());

This is done in a Servlet Filter, that is mapped to all the site (the filter has the url pattern as "/*")

1. How can I make this filter run only once ? That is, at the login, or
2. Do I really have to run at each request and check if this cookie has been already marked and skip if the answer is "yes" ?


Any suggestions ?

PS: 

 1. Don't tell me to upgrade to Servlet 3.0 because I can't do that right now
 2. Ignore the improper use of the StringBuilder and missing variable sessionId
How do I update the cookie JSESSIONID with HttpOnly by working directly on Http Headers?
===

**Here is the big picture**

I want to append "HttpOnly" to the JSESSIONID Cookie, but I want to do this by hand, meaning:

    //create a new cookie
    StringBuilder updatedCookie = new StringBuilder("JSESSIONID").append("=")
    				.append(sessionId).append("; Path=").append("/")
    				.append("; HttpOnly");

    //save the cookie
    response.setHeader("SET-COOKIE", updatedCookie.toString());

This is done in a Servlet Filter, that is mapped to all the site (the filter has the url pattern as "/*")

1. How can I make this filter run only once ? That is, at the login, or
2. Do I really have to run at each request and check if this cookie has been already marked and skip if the answer is "yes" ?


Any suggestions ?

PS: 

 1. Don't tell me to upgrade to Servlet 3.0 because I can't do that right now
 2. Ignore the improper use of the StringBuilder and missing variable sessionId