Add HttpOnly flag to cookies on the fly using Apache?

Question

So, I have java webapp that uses tomcat with apache proxy level. I want all cookies set in the app to have the httpOnly flag. The problem is that tomcat is responsible for setting the flag on the application side, and its default value (in api 2.5 servlets) is false. I was hoping I could set this flag for all cookies on the fly using apache.

I tried different combinations, and the closest I received sets the last cookie sent by httpOnly, which of course is wrong:

Header append Set-Cookie "; HttpOnly" 

I have no way of knowing which cookies / values ​​will be sent from the application. Is it possible?

Answer 1

Try the following mod_headers directive.

 Header edit Set-Cookie ^(.*)$ $1;HttpOnly 

Answer 2

In the next revision of mod_headers, the advantage is that it will not duplicate HttpOnly if it already exists, if it matters to you:

  Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly" 

Cm:

• Where I originally found the above expression
• An explanation of why all those parentheses with a negative statement to view are searched by searching for strings containing or not containing specific words
• A post in which I found a slight improvement for regular expression (search for the Edit Set-Cookie header)