Weblogic does not accept the secure flag directive

Weblogic does not accept the secure flag directive specified in the deployed application configuration.

It continues to display the session id (JSESSIONID) without the secure flag set.

The following is a snippet from the deployed application web.xml

...

...

    <session-config>

        <session-timeout>15</session-timeout>

        <cookie-config>

          <http-only>true</http-only>

          <secure>true</secure>

        </cookie-config>           

        <tracking-mode>COOKIE</tracking-mode>

    </session-config>

...

...

The following is a snippet from the deployed application weblogic.xml

...

...

   <session-descriptor>

     <cookie-secure>true</cookie-secure>

     <cookie-http-only>true</cookie-http-only> 

     <url-rewriting-enabled>false</url-rewriting-enabled>

   </session-descriptor>

...

...

SSL has been enabled and the SSL port has also been specified for the application using the weblogic admin console.

As per the weblogic documentation, setting the secure flag in the configuration file (weblogic.xml) will cause weblogic to use a new cookie over SSL (_WL_AUTHCOOKIE_JSESSIONID) in addition to the JSESSIONID cookie. The _WL_AUTHCOOKIE_JSESSIONID cookie will only be transmitted over SSL.