title: How to set 'secure' and 'httponly' cookie in Tornado?
body: <p>I have a Tornado app which uses Google Oauth 2.0 Authentication, gets the email and sets that in a cookie. Now I don't want anyone else to access this cookie, copy the value and get another user's details on my app. So I want to make this cookie <code>httponly</code> and <code>secure</code> cookie. However when I pass these as arguments its not able to set the cookie:</p>
  
  <pre><code>self.set_secure_cookie('trakr', email, secure=True, httponly=True)
  </code></pre>
  
  <p>I am suing Tornado 3.2.2 and Python 2.7.5.</p>
  
  <p>since its not able to set the cookie, it keeps redirecting to google auth page. Here is my code:</p>
  
  <pre><code>class GAuthLoginHandler(BaseHandler, tornado.auth.GoogleOAuth2Mixin):
      @tornado.gen.coroutine
      def get(self):
          if self.get_current_user():
              self.redirect('/products')
              return
  
          if self.get_argument('code', False):
              user = yield self.get_authenticated_user(redirect_uri=settings.google_redirect_url,
                  code=self.get_argument('code'))
              if not user:
                  self.clear_all_cookies() 
                  raise tornado.web.HTTPError(500, 'Google authentication failed')
  
              access_token = str(user['access_token'])
              http_client = self.get_auth_http_client()
              response =  yield http_client.fetch('https://www.googleapis.com/oauth2/v1/userinfo?access_token='+access_token)
              user = json.loads(response.body)
              self.set_secure_cookie('trakr', user['email'], secure=True, httponly=True)
              self.redirect(self.get_argument("next", "/products"))
              return
  
          elif self.get_secure_cookie('trakr'):
              self.redirect('/products')
              return
  
          else:
              yield self.authorize_redirect(
                  redirect_uri=settings.google_redirect_url,
                  client_id=self.settings['google_oauth']['key'],
                  scope=['email'],
                  response_type='code',
                  extra_params={'approval_prompt': 'auto'})
  </code></pre>
  
  <p>The code works perfectly fine when I remove <code>secure</code> and <code>httponly</code> arguments. It also works if I just send <code>httponly</code> argument, however it doesn't seem to set the cookie when I pass both the arguments. </p>
  
  <p>Am I doing something wrong?</p>