On your way in you may have missed that we have a policy on screen names here at JavaRanch. Basically, it must consist of a first name, a space, and a last name, and not be obviously fictitious. Since yours does not conform with it, please take a moment to change it, which you can do right here.
As to your question, I'm not sure what you mean by an "HTTP-only cookie". Cookies are used only with HTTP, not with other protocols. I'm going to move the question to the Struts forum. [ October 26, 2007: Message edited by: Ulf Dittmer ]