title: Setting HTTPONLY for Classic Asp Session Cookie
body: <p>Does anyone know exactly how to set HTTPONLY on classic ASP session cookies?</p>
  
  <p>This is the final thing that's been flagged in a vulnerability scan and needs fixing ASAP, so any help is appreciated.</p>
  
  <p>~~~A LITTLE MORE INFORMATION ON MY PROBLEM~~~</p>
  
  <p><strong>Can anyone please help me with this?</strong></p>
  
  <p>I need to know how to set HTTPONLY on the ASPSESSION cookie created by default from ASP &amp; IIS.</p>
  
  <p>This is the cookie automatically created by the server for all asp pages.</p>
  
  <p>If needed i can set HTTPONLY on all cookie across the site.</p>
  
  <p>Any help on how to do this would be massively appreciated.</p>
  
  <p>Thanks</p>
  
  <p>Thanks
  Elliott</p>