<p>I'd like to add the <code>HttpOnly</code> flag to <code>JSF/richfaces</code> cookies, especially the session cookie, to up the level of security on my web app. Any ideas? </p>

Something like:
```
```
response.setHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");
```
```
might work in a Java environment. I am not aware of a JSF-specific way to achieve this... sorry
This seems to be not an easy task in Java.