scalatra/scalatra — Issue #158: CookieSupport ignores HttpOnly (both of 2.0.3, 2.1.0-SNAPSHOT)
Author: seratch
Created: 2012-02-22 10:06:43+00:00
State: open

org.scalatra.Cookie has the httpOnly attribute, but it does not work as required.

In detail, SweetCookies#update should append "; HttpOnly" if CookieOptions#httpOnly is true, but it is ignored.

CookieSupport still depends on servlet-api 2.5.

And I think there is no other way but using HttpServletResponse#addHeader("Set-Cookie", "...; HttpOnly"). If this approach isn't bad, I'll send a pull request.

Can you please check on it? Thanks.