'I get error "Forbidden" after setting http-only in wildfly
i want to ask the reason why i get an error "Forbidden". After i setting wildfly cookie to http only ?
I have a website in development, and then my client hire the pentester to test my site. And one issue they found is, i have to set http-only on my cookie to make it secure from XSS.
After googling i found the solution, i must set <session-cookie http-only="true" secure="true"/>.
After i set this i can't login using http, but i can login if i using https.
So can anyone give me the explanation why i need https to login ?why i get an error "Forbidden" ? because the pentester said "you didn't need https".
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|