Missing HttpOnly Flag From Cookie and Missing Secure Flag From SSL Cookie vulnerability (4255355)

Open up <STAT_HOME>/app/standalone/configuration/standalone-full.xml and locate the following:

            <servlet-container name="default">

                <jsp-config development="false"/>

                <websockets/>

            </servlet-container>

Add this line: <session-cookie http-only="true" secure="true"/>

After the change, it should look like this:

            <servlet-container name="default">

                <session-cookie http-only="true" secure="true"/>

                <jsp-config development="false"/>

                <websockets/>

            </servlet-container>

Restart the Stat central agent.