<p>Inspired by this CodingHorror article, "<a href="http://www.codinghorror.com/blog/archives/001167.html" rel="noreferrer">Protecting Your Cookies: HttpOnly</a>"</p>

<p>How do you set this property? Somewhere in the web config?</p>

[{'answer_id': 33532, 'author': 'Dillie-O', 'author_id': 71, 'author_profile': 'https://Stackoverflow.com/users/71', 'pm_score': 4, 'selected': False, 'text': '<p>With props to Rick (second comment down in the blog post mentioned), here\'s the <a href="http://msdn.microsoft.com/en-us/library/system.web.configuration.httpcookiessection.httponlycookies.aspx" rel="noreferrer">MSDN article</a> on httpOnlyCookies.</p>\n\n<p>Bottom line is that you just add the following section in your system.web section in your web.config:</p>\n\n<pre><code>&lt;httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" /&gt;\n</code></pre>\n'}, {'answer_id': 33541, 'author': 'Corey McKinnon', 'author_id': 633, 'author_profile': 'https://Stackoverflow.com/users/633', 'pm_score': 7, 'selected': True, 'text': '<p>If you\'re using ASP.NET 2.0 or greater, you can turn it on in the Web.config file. In the &lt;system.web&gt; section, add the following line:</p>\n\n<pre><code>&lt;httpCookies httpOnlyCookies="true"/&gt;\n</code></pre>\n'}, {'answer_id': 33887, 'author': 'Portman', 'author_id': 1690, 'author_profile': 'https://Stackoverflow.com/users/1690', 'pm_score': 3, 'selected': False, 'text': '<p>If you want to do it in code, use the <a href="http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx" rel="noreferrer">System.Web.HttpCookie.HttpOnly</a> property.</p>\n\n<p>This is directly from the MSDN docs:</p>\n\n<pre><code>// Create a new HttpCookie.\nHttpCookie myHttpCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());\n// By default, the HttpOnly property is set to false \n// unless specified otherwise in configuration.\nmyHttpCookie.Name = "MyHttpCookie";\nResponse.AppendCookie(myHttpCookie);\n// Show the name of the cookie.\nResponse.Write(myHttpCookie.Name);\n// Create an HttpOnly cookie.\nHttpCookie myHttpOnlyCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());\n// Setting the HttpOnly value to true, makes\n// this cookie accessible only to ASP.NET.\nmyHttpOnlyCookie.HttpOnly = true;\nmyHttpOnlyCookie.Name = "MyHttpOnlyCookie";\nResponse.AppendCookie(myHttpOnlyCookie);\n// Show the name of the HttpOnly cookie.\nResponse.Write(myHttpOnlyCookie.Name);\n</code></pre>\n\n<p>Doing it in code allows you to selectively choose which cookies are HttpOnly and which are not.</p>\n'}, {'answer_id': 770764, 'author': 'Matthew Lock', 'author_id': 74585, 'author_profile': 'https://Stackoverflow.com/users/74585', 'pm_score': 2, 'selected': False, 'text': '<p>Interestingly putting <code>&lt;httpCookies httpOnlyCookies="false"/&gt;</code> doesn\'t seem to disable <code>httpOnlyCookies</code> in ASP.NET 2.0. Check this article about <a href="http://nerd.steveferson.com/2007/09/14/act-sessionid-and-login-problems-with-asp-net-20/" rel="nofollow noreferrer">SessionID and Login Problems With ASP .NET 2.0</a>.</p>\n\n<p>Looks like Microsoft took the decision to not allow you to disable it from the web.config. Check this <a href="http://forums.asp.net/p/976773/1240648.aspx" rel="nofollow noreferrer">post on forums.asp.net</a></p>\n'}]
['https://Stackoverflow.com/questions/33529', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1842/']