According to the Microsoft Developer Network, HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).

If the HttpOnly flag (optional) is included in the HTTP response header, the cookie cannot be accessed through client side script (again if the browser supports this flag). As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.

Using Java to Set HttpOnly

Cookie cookie = getMyCookie("myCookieName");

Moreover since JEE 6 it's also declaratively easy setting HttpOnly flag in session cookie, by applying the following configuration in the deployment descriptor WEB-INF/web.xml:

<session-config> <cookie-config> <http-only>true</http-only> </cookie-config> </session-config>

  • Tomcat 6 In context.xml set the context tag's attribute useHttpOnly [7] as follow:
  • <?xml version="1.0" encoding="UTF-8"?> <Context path="/myWebApplicationPath" useHttpOnly="true">
  • JBoss 5.0.1 and JBOSS EAP 5.0.1 In \server\<myJBossServerInstance>\deploy\jbossweb.sar\context.xml set the SessionCookie tag [8] as follow:
  • <Context cookies="true" crossContext="true">
    <SessionCookie secure="true" httpOnly="true" />

Using .NET to Set HttpOnly

Using PHP to set HttpOnly