By default, Tomcat 7 sets HttpOnly to false on all session cookies. Since, by default, the HttpOnly flag will be set on session cookies, all client side scripts will be prevented This prevents any client side script from accessing the session ID. DWR uses the session cookie (and the session ID) to protect against cross site scripting attacks. With HTTPOnly set to false, DWR will start popping up “CSRF Security Error” dialogs. To prevent DWR from popping up “CSRF Security Error” dialogs, useHttpOnly must be set to true. |