On Wed, Apr 23, 2014 at 10:04 AM, stephanos <[email protected]> wrote:
> how do we make our JSESSIONID-Cookie HttpOnly? > We know that App Engine runs on Servlet 2.5 which doesn't support this > flag, but there must be a way around this. > I don't believe there's a way to do that. If you want a workaround, you could try hosting a HTTPS version of your site on one subdomain, and the regular HTTP version on another subdomain. Mark the cookie as only available on a single subdomain. ----------------- -Vinny P Technology & Media Advisor Chicago, IL App Engine Code Samples: http://www.learntogoogleit.com -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/google-appengine. For more options, visit https://groups.google.com/d/optout.
