httponly Questions
1
Solved
I have a Django application and am configuring some security settings. One of the settings is the SESSION_COOKIE_HTTPONLY flag. I set this flag to True.
On session creation (login) I can see the ...
1
I have a JWT token that I'd like to store in a cookie. The cookie needs to have at least HttpOnly flag set, but I would also want to set the Secure flag to true.
From the angular docs I know I can...
Charades asked 10/5, 2015 at 19:27
1
I found numerous examples of adding the HttpOnly to my cookies but it does not work for me and I am not sure why. All the examples I found were the same and I copied this one from one of the posts ...
Illbred asked 4/9, 2014 at 23:28
1
I used Servlet 3.0 and I want secure my cookies with HttpOnly flag. my web.xml is
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
x...
1
Solved
I have setup my ColdFusion application to set HTTPOnly cookies using the code below (from http://www.petefreitag.com/item/764.cfm):
<cfcomponent output="false">
<cfscript>
THIS.Name ...
Crazed asked 21/4, 2014 at 16:14
1
I can see that HttpOnly cookies are good for security, however they make logging out without server interaction impossible, right?1 So when the network fails, you can't log out and leave. I can ima...
Guard asked 24/3, 2014 at 15:15
2
I'm trying to set the httponly flag on the JSESSIONID cookie. I'm working in Java EE 5, however, and can't use setHttpOnly(). First I tried to create my own JSESSIONID cookie from within the servle...
Ajmer asked 7/6, 2010 at 19:29
3
Solved
I want to make my session cookie HttpOnly. Based on this article, I added this to my application.ini:
resources.session.cookie_httponly = true
Unfortunately, when I look at the session cookie in...
Overriding asked 16/12, 2010 at 14:53
2
Solved
I am setting cookies as part of my mvc application:
var cookie = new HttpCookie(CookieName, encryptedData)
{
Path = FormsAuthentication.FormsCookiePath,
Domain = CookieDomain,
Expires = authen...
Nutter asked 27/2, 2013 at 18:56
1
Solved
What should be the correct behaviour of browser when sending and receiving httponly cookie via ajax?
I currently have an issue with Firefox where it receives a cookie with httponly flag. However when a subsequent response is sent to the server the request does not contain any httponly flag (which ...
0
From everything I've read online, a web.config like this should enable HttpOnly cookies, in ASP.NET 2.0. However this is not working.
<configuration>
<system.web>
<httpCookies http...
Gunderson asked 30/11, 2012 at 16:47
1
Solved
I am using Ruby and Sinatra to develop an application.
I use
enable :sessions
in order to use the session variable provided by rack. How can I make all of the session cookies be HTTPOnly? Is it ...
2
How can i get a httponly cookie in a httpwebresponse ?
Habitually i use a CookieContainer to get the cookies in a httpwebresponse, but it doesnt work with httponly cookie.
Is there an other way to...
1
I'm trying to create a cookie, with the HttpOnly flag enabled.
While there seems to be a plethora of resources about how to do it in Java and .Net, I need to do it in javascript.
Here is my (curr...
Eward asked 15/2, 2011 at 2:23
1
Solved
I have a slight confusion regarding HTTPOnly attribute in cookies. I am aware that its main use is for protection against XSS attacks. Let us assume there is web application which has set httponly ...
Spessartite asked 22/5, 2012 at 8:24
2
Solved
I'm trying to turn httponly off for use in phonegap. I'm useing rails 3.1 and devise, each of which have reported (but not documented) ways of doing this, none of which work:
# application.rb
conf...
Ly asked 2/12, 2011 at 4:42
1
Solved
If I already set SSL for my application server, do I still need to set HttpOnly for the cookies?
3
We need to ensure that all cookies on a CF7 site are set as HttpOnly.
We are using jsessionid to control our sessions, and JRun does not create this as HttpOnly.
Whilst it is possible to modify a...
Catron asked 26/6, 2009 at 10:41
2
Solved
If my application places HttpOnly cookies on a client and then needs to remove them how can you remove them completely?
2
Solved
Is there a way to check if the cookie is httponly in php?
9
JavaScript needs access to cookies if AJAX is used on a site with access restrictions based on cookies. Will HttpOnly cookies work on an AJAX site?
Edit: Microsoft created a way to prevent XSS at...
4
Solved
Inspired by this CodingHorror article, "Protecting Your Cookies: HttpOnly"
How do you set this property? Somewhere in the web config?
2
Solved
Which browsers do support HttpOnly cookies, and since which version?
Please see http://www.codinghorror.com/blog/archives/001167.html for a discussion of HttpOnly cookies and XSS-prevention.
© 2022 - 2024 — McMap. All rights reserved.