Setting the httpOnly flag does not work when deployed in a servlet container

Hello,

Play 1.5.x allows you to set the cookies as HttpOnly using this configuration:
application.session.httpOnly=true
It works well when starting Play framework, but not when packaging the application as WAR in a servlet container (we use Jetty for instance).

It seems that Play uses a dependency on servlet-api-2.5.jar, and in this version, the javax.servlet.http.Cookie class does not contain yet the httpOnly flag. It is only available in servlet API > 3.0:
https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html

There are some "tricks" to append ";HTTPOnly;" to the path, but it also seems to have some side effects in some browser

To reproduce the issue, you need to simply create a Cookie in a Controller:

cookie.path = "/";
cookie.name = "TEST-NAME";
cookie.value = "TEST-VALUE";
cookie.domain = Http.Cookie.defaultDomain;
cookie.secure = false;
cookie.httpOnly = true;
Http.Response.current().cookies.put(cookie.name, cookie);

Then package as WAR and deploy it on a servlet container.

Once deployed, navigate to the Controller's page and using the browser dev tools, you will see that the httpOnly flag is not set on the cookie.
I don't know if upgrading to servlet 3.0 would have a lot of side effects though.

Fabien

Start with the Controller reproduction described in the issue, the application.session.httpOnly setting, and the servlet-api-2.5 dependency while comparing standalone and WAR deployments on Jetty. Verify the deployed response with browser developer tools; done means cookies created with httpOnly=true retain the HttpOnly flag in a servlet container without breaking the existing deployment path.