How can a servlet indicate to the browser that cookie data should be sent over a secure connection?

Question

Options

• ACall the getSecure(true) method on the cookie object.
• BEncrypt the cookie data. The browser automatically sends encrypted data over a secure
• CSet the ENCRYPT header in the response.
• DConfigure SessionTrackingMode.SSL on the ServletContext object.

• A
  89% (25)
• C
  7% (2)
• D
  4% (1)

Explanation

Calling setSecure(true) on a Cookie object (the method in option A is misnamed - it should be setSecure, not getSecure, but this is the intended answer) instructs the browser to transmit that cookie only over HTTPS connections, which is the standard Servlet API mechanism for securing cookie transport. Option B is wrong because encrypting cookie data is a separate concern from transport security - the browser doesn't infer connection type from data format. Option C is wrong because no ENCRYPT response header exists in the HTTP specification or Servlet API. Option D is wrong because SessionTrackingMode.SSL configures how the session ID is tracked (via SSL session identifiers rather than cookies or URL rewriting), not whether cookies are sent securely.

Memory tip: Think "set = secure" - you set the secure flag on the cookie to lock it to HTTPS. The getSecure() method only reads the flag; setSecure(true) is what enforces it.

No community discussion yet for this question.