Set Secure and HttpOnly Cookies in Apache 2.2.4

* See this post to configure mod_jk module for Apache 2.2 and Tomcat 7
* Make sure mod_headers is loaded:

# grep mod_headers.so httpd.conf
LoadModule headers_module modules/mod_headers.so

* Add to httpd.conf
Header edit Set-Cookie ^(.*)$ $1;Secure;HttpOnly
– or to prevent duplicate HttpOnly tag:
Header edit Set-Cookie “(?i)^((?:(?!;\s?HttpOnly).)+)$” “$1; HttpOnly”
* Restart Apache

* Install and start Fiddler2

* Point browser to http://openidmbox/examples/servlets/servlet/CookieExample

* Check Fiddler and you should see
Set-Cookie: testname=testvalue

* Check Fiddler and you should see
Set-Cookie: testname=testvalue;Secure;HttpOnly

* OWASP httpOnly
* http://stackoverflow.com/questions/4998398/add-httponly-flag-to-cookies-on-the-fly-with-apache
* http://chandank.com/security/httponly-secure-cookie-apache