Home/ Questions/Q 7019581
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T23:12:07+00:00

I have my GWT code in an index.jsp page, and when I view the

  • 0

I have my GWT code in an index.jsp page, and when I view the page info (security/cookies), I see the JSESSIONID cookie assigned to ‘subdomain.mysite.com’.

When in my client-side code, I do this:

Window.alert("cookies=" + Cookies.getCookieNames().toString);

I see two cookies that are assigned to ‘mysite.com’, but I do not see the JSESSIONID. The current url for the page is ‘subdomain.mysite.com’ – shouldn’t it be giving me the cookie?
When I refresh, or display the cookies on a click event, I still do not see the JSESSIONID cookie.

Why can’t I get it on the client side?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Is your application server configured to set the HTTPOnly flag on the JSESSIONID cookie? If so, client side code will not be able to see it

    See https://www.owasp.org/index.php/HttpOnly

    It is generally good security practice to set the HTTPOnly flag – can you clarify why you want access to the JSESSIONID cookie in your client side code?

    • 0