Configuring application security for web applications

All web applications that are installed on IBM® WebSphere® Application Server are set to secure for cookies and single sign-on. You must use HTTPS and the secure port number to access the web application as HTTP is no longer valid.

1. To locate the secure port number, open the WebSphere Application Server administrative console and go to the Server Types > WebSphere application servers > %WEB_SERVER_NAME% > Ports and find WC_defaulthost_secure.
2. To set the secure attribute to force HTTPS:
   1. Go to the Server Types > WebSphere application servers > %SERVER_NAME% > Session management.
   2. Under the Enable cookies menu, select the Restrict cookies to HTTPS sessions option.
   3. Go to Security > Global security > Authentication > Web and SIP security > Single sign-on (SSO) and select the Requires SSL option.