@@ -0,0 +1,1155 @@
+package se.omegapoint.facepalm.client.config;%0A%0Aimport org.apache.catalina.Context;%0Aimport org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;%0Aimport org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer;%0Aimport org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;%0Aimport org.springframework.context.annotation.Bean;%0Aimport org.springframework.context.annotation.Configuration;%0A%0Aimport static java.util.Collections.singletonList;%0A%0A@Configuration%0Apublic class TomcatConfig %7B%0A%0A    @Bean%0A    public EmbeddedServletContainerFactory servletContainerFactory() %7B%0A        TomcatEmbeddedServletContainerFactory factory = new TomcatEmbeddedServletContainerFactory();%0A        factory.setTomcatContextCustomizers(singletonList(new HttpCustomizer()));%0A        return factory;%0A    %7D%0A%0A    private static class HttpCustomizer implements TomcatContextCustomizer %7B%0A%0A        @Override%0A        public void customize(final Context context) %7B%0A            context.setUseHttpOnly(false); // Defaults to true, protects against session cookie leakage in client (dont fix as contributer)%0A        %7D%0A    %7D%0A%7D%0A

Disable automatic HttpOnly protection on session cookies