<p>The page <em><a href="http://www.codinghorror.com/blog/archives/001167.html" rel="noreferrer">Protecting Your Cookies: HttpOnly</a></em> explains why making HttpOnly cookies is a good idea.</p>

<p>How do I set this property in Ruby on Rails?</p>

[{'answer_id': 72287, 'author': 'Michael Haren', 'author_id': 29, 'author_profile': 'https://Stackoverflow.com/users/29', 'pm_score': 3, 'selected': False, 'text': '<p>Just set :http_only to true as described in the <a href="http://dev.rubyonrails.org/changeset/7525" rel="noreferrer">changelog</a>.</p>\n'}, {'answer_id': 72621, 'author': 'Laurie Young', 'author_id': 7473, 'author_profile': 'https://Stackoverflow.com/users/7473', 'pm_score': 6, 'selected': True, 'text': '<p>Set the \'http_only\' option in the hash used to set a cookie</p>\n\n<p>e.g. <pre>cookies["user_name"] = { :value => "david", :httponly => true }</pre></p>\n\n<p>or, in Rails 2:</p>\n\n<p>e.g. <pre>cookies["user_name"] = { :value => "david", :http_only => true }</pre></p>\n'}, {'answer_id': 168326, 'author': 'Pelle', 'author_id': 10724, 'author_profile': 'https://Stackoverflow.com/users/10724', 'pm_score': 1, 'selected': False, 'text': '<p>I also wrote a patch that is included in Rails 2.2, which defaults the CookieStore session to be http_only. </p>\n\n<p>Unfortunately session cookies are still by default regular cookies.</p>\n'}, {'answer_id': 4470104, 'author': 'jim', 'author_id': 468629, 'author_profile': 'https://Stackoverflow.com/users/468629', 'pm_score': 4, 'selected': False, 'text': "<p>Re Laurie's answer:</p>\n\n<p>Note that the option was renamed from <code>:http_only</code> to <code>:httponly</code> (no underscore) at some point.</p>\n\n<p>In actionpack 3.0.0, that is, Ruby on Rails 3, all references to <code>:http_only</code> are gone.</p>\n\n<p>That threw me for a while.</p>\n"}, {'answer_id': 40474742, 'author': 'ilgam', 'author_id': 3834822, 'author_profile': 'https://Stackoverflow.com/users/3834822', 'pm_score': 2, 'selected': False, 'text': '<p>If you’ve a file called config/session_store.rb including this line (Rails 3+), then it’s automatically set already.\n<code>config/initializers/session_store.rb</code>:</p>\n\n<pre><code># Be sure to restart your server when you modify this file.\nRails.application.config.session_store :cookie_store, key: "_my_application_session"\n</code></pre>\n\n<p>Also rails allows you to set following keys:</p>\n\n<p><strong>:expires</strong> - <em>The time at which this cookie expires, as a Time object.</em></p>\n\n<p><strong>:secure</strong> - <em>Whether this cookie is only transmitted to HTTPS servers. Default is false.</em></p>\n'}]
['https://Stackoverflow.com/questions/72242', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/7473/']