How to configure JBoss 5.1.* to make session cookie HttpOnly?
<Context useHttpOnly="true">
Doesn't work.
Have you tried
<SessionCookie secure="true" httpOnly="true" />
as explained here.