方法一 application.yml 里设置

server:
port: 80
servlet:
session:
tracking-modes: cookie
cookie:
http-only: true

方法二 启动类继承SpringBootServletInitializer 类，重写 onStartup 方法

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration;
import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.SessionCookieConfig;
import javax.servlet.SessionTrackingMode;
import java.util.Collections;

@SpringBootApplication(exclude = DataSourceAutoConfiguration.class)
public class NdaDemoApplication extends SpringBootServletInitializer {

public static void main(String[] args) {
SpringApplication.run(NdaDemoApplication.class, args);
}
public void onStartup(ServletContext servletContext)throws ServletException {
super.onStartup(servletContext);
servletContext.setSessionTrackingModes(Collections.singleton(SessionTrackingMode.COOKIE));
SessionCookieConfig sessionCookieConfig = servletContext.getSessionCookieConfig();
sessionCookieConfig.setHttpOnly(true);
}
}