By default, Tomcat 7 sets HttpOnly to false on all session cookies. Since, by default, the HttpOnly flag will be set on session cookies, This prevents all client side scripts will be prevented from accessing the session ID. DWR uses the session cookie to protect against cross site scripting attacks. With HTTPOnly set to false, DWR will start popping up “CSRF Security Error” dialogs. To prevent DWR from popping up “CSRF Security Error” dialogs, useHttpOnly must be set to true. |