title: How to set HttpOnly flag In Node.js ,Express.js application?
body: <p>Hi I have a project in <code>node.js</code> and I want to set the <strong>HttpOnly flag: true</strong> for header response.</p>
  
  <p>I have written the following code in <code>app.js</code> but it make no effect in response header .</p>
  
  <pre><code>app.use(session({
   secret: "notagoodsecretnoreallydontusethisone",
   resave: false,
   saveUninitialized: true,
   cookie: {httpOnly: true, secure: true}
  }));
  </code></pre>
  
  <p>So any suggestion for setting <strong>HttpOnly Flag</strong> in <code>express.js</code> is most welcome.</p>