apereo · mmoayyed · May 17, 2016 · May 13, 2016 · May 13, 2016 · May 16, 2016
diff --git a/...bapp-support/src/main/java/org/jasig/cas/web/support/CookieRetrievingCookieGenerator.java b/...bapp-support/src/main/java/org/jasig/cas/web/support/CookieRetrievingCookieGenerator.java
@@ -65,12 +65,6 @@ public CookieRetrievingCookieGenerator() {
      */
     public CookieRetrievingCookieGenerator(final CookieValueManager casCookieValueManager) {
         super();
-        final Method setHttpOnlyMethod = ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", boolean.class);
-        if(setHttpOnlyMethod != null) {
-            super.setCookieHttpOnly(true);
-        } else {
-            logger.debug("Cookie cannot be marked as HttpOnly; container is not using servlet 3.0.");
-        }
         this.casCookieValueManager = casCookieValueManager;
     }
     /**
@@ -92,6 +86,14 @@ public void addCookie(final HttpServletRequest request, final HttpServletRespons
             if (isCookieSecure()) {
                 cookie.setSecure(true);
             }
+            if (isCookieHttpOnly()) {
+                final Method setHttpOnlyMethod = ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", boolean.class);
+                if(setHttpOnlyMethod != null) {
+                    cookie.setHttpOnly(true);
+                } else {
+                    logger.debug("Cookie cannot be marked as HttpOnly; container is not using servlet 3.0.");
+                }
+            }
             response.addCookie(cookie);
         }
     }

diff --git a/cas-server-webapp/src/main/webapp/WEB-INF/spring-configuration/warnCookieGenerator.xml b/cas-server-webapp/src/main/webapp/WEB-INF/spring-configuration/warnCookieGenerator.xml
@@ -31,6 +31,7 @@
     </description>
 
     <bean id="warnCookieGenerator" class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
+          p:cookieHttpOnly="true"
           p:cookieSecure="true"
           p:cookieMaxAge="-1"
           p:cookieName="CASPRIVACY"