monline

In Tomcat 5.* and 6.* this was not an issue, because by default Tomcat configuration did not add the HttpOnly flag to the session cookie, thus JavaScript in webapp generated pages could access it.
Reference on this:

• Tomcat 5.5
• Tomcat 6.0

However the default value of the useHttpOnly context parameter was changed from false to true in Tomcat 7.0.