18

I'm trying to figure out how to set the HttpOnly attribute for the set-cookie header, specifically for native NodeJS.

Right now, I have this code, but it doesn't work because I can still access the cookies with client side javascript.

response.setHeader('Set-Cookie', ['HttpOnly']);
Improve this question

1 Answer 1

Reset to default
34

To set cookie, you need to specify cookie name and value, which is missing in your code. That's why it does not work. Example code would be:

response.setHeader('Set-Cookie', 'foo=bar; HttpOnly');

If you want to set multiple cookies, some with HttpOnly, some without. The code would be:

response.setHeader('Set-Cookie', ['foo=bar; HttpOnly', 'x=42; HttpOnly', 'y=88']);

According to Node.js HTTP document, there is no global HttpOnly configuration, which makes sense, as normally you may need some cookie client readable.

Improve this answer
1
  • Oh I see. I misinterpreted the NodeJS documentation, but you cleared it up. Thanks for your help!
    – Artur
    Commented Mar 21, 2017 at 2:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.