How to set httponly attribute in cookie to true

Setting the cookie to HttpOnly is to prevent XSS attacks and steal the cookie content, which increases the security of the cookie. Even so, do not store important information in the cookie. 

How to set cookie in Java is HttpOnly? Look at 
Servlet 2.5 API does not support cookie setting. HttpOnly 

recommends upgrading Tomcat 7.0, which has already implemented Servlet 3.0, 

but the reality is that the boss will not let you upgrade. 
Then introduce another method: use the addHeader method of HttpResponse to set the format of the value cookie string of 
Set-Cookie : key=value; Expires=date; Path=path; Domain=domain; Secure; HttpOnly //Set cookie response .addHeader("Set-Cookie", "uid=112; Path=/; HttpOnly"); //Set multiple cookies response.addHeader("Set-Cookie", "uid=112; Path=/; HttpOnly") ; response.addHeader("Set-Cookie", "timeout=30; Path=/test; HttpOnly"); //Set https cookie response.addHeader("Set-Cookie", "uid=112; Path=/; Secure;












In actual use, we can make FireCookie see if the cookie we set is HttpOnly