How to protect jsessionid cookie in tomcat 7 using environment variables

Question

This is another JSESSIONID cookie security issue in tomcat 7.

I use a cloud server, where we do not have access to tomcat server.xml, but we can set environment variables and tomcat system variables.

I need to change the settings below:

<Connector port=" ... /> 

And add the attribute secure = "true" using only the properties of the environment. Is there some kind of tomcat environment that I can install. For example, we have the tomcat environment variable:

  `logging.dir=/logs/tomcatlogs` 

I am using dynamic web module version 2.4 and java 7.

Answer 1

Unfortunately (for your purposes) this setting is suitable for each connector and will affect all applications on this connector. It is not possible to set this except for the connector level.

If you really want to affect only certain applications deployed on the server, you can ask the server administrators to define a new connector (you need a different port) and just install it, but this requires administrator intervention, which it looks like you tried to avoid.