<session-config>
    <cookie-config>
        <http-only>true</http-only>
    </cookie-config>
</session-config>