title: Fix the issue of "Cookie Does Not Contain The HTTPOnly Attribute" on the client side
body: <p>A recent security scan of my site indicates that the site has this issue:</p>
  
  <pre><code>Cookie Does Not Contain The "HTTPOnly" Attribute
  </code></pre>
  
  <p>I did research and found links about the fix. For example:</p>
  
  <p><a href="https://www.owasp.org/index.php/HttpOnly" rel="nofollow noreferrer">https://www.owasp.org/index.php/HttpOnly</a></p>
  
  <p>However, all the links talk about doing some work on the server side through code or configuration. The way I do cookies on this site is adding/removing cookies via Javascript with the help of jquery-cookie found here</p>
  
  <p><a href="https://github.com/carhartl/jquery-cookie" rel="nofollow noreferrer">https://github.com/carhartl/jquery-cookie</a></p>
  
  <p>So, how can I fix this security issue?</p>
  
  <p><strong>Updates</strong></p>
  
  <p>Thank @cody for pointing me to another post. Basically, no client-side solution. Then another question:</p>
  
  <p>Do I have to migrate my cookie-related Javascript code into server-side code (e.g., C# in my case)? I guess the answer is yes. I also guess that server-side configuration only (IIS in my case) won't work. Just wanted to check with experts here. </p>