How exactly do you configure httpOnlyCookies in ASP NET

Question

Inspired by this CodingHorror article   Protecting Your Cookies  HttpOnly   How do you set this property  Somewhere in the web config

User · Accepted Answer

If you re using ASP NET 2 0 or greater  you can turn it on in the Web config file  In the  lt system web gt  section  add the following line    lt httpCookies httpOnlyCookies  true   gt

User · Answer

With props to Rick  second comment down in the blog post mentioned   here s the MSDN article on httpOnlyCookies   Bottom line is that you just add the following section in your system web section in your web config    lt httpCookies domain    httpOnlyCookies  true false  requireSSL  true false    gt

User · Answer

Interestingly putting  lt httpCookies httpOnlyCookies  false   gt  doesn t seem to disable httpOnlyCookies in ASP NET 2 0  Check this article about SessionID and Login Problems With ASP  NET 2 0   Looks like Microsoft took the decision to not allow you to disable it from the web config  Check this post on forums asp net

User · Answer

If you want to do it in code  use the System Web HttpCookie HttpOnly property   This is directly from the MSDN docs      Create a new HttpCookie  HttpCookie myHttpCookie   new HttpCookie  LastVisit   DateTime Now ToString        By default  the HttpOnly property is set to false     unless specified otherwise in configuration  myHttpCookie Name    MyHttpCookie   Response AppendCookie myHttpCookie      Show the name of the cookie  Response Write myHttpCookie Name      Create an HttpOnly cookie  HttpCookie myHttpOnlyCookie   new HttpCookie  LastVisit   DateTime Now ToString        Setting the HttpOnly value to true  makes    this cookie accessible only to ASP NET  myHttpOnlyCookie HttpOnly   true  myHttpOnlyCookie Name    MyHttpOnlyCookie   Response AppendCookie myHttpOnlyCookie      Show the name of the HttpOnly cookie  Response Write myHttpOnlyCookie Name     Doing it in code allows you to selectively choose which cookies are HttpOnly and which are not

[asp.net] How exactly do you configure httpOnlyCookies in ASP.NET?

Examples related to asp.net

Examples related to cookies

Examples related to xss

Examples related to httponly