Re: Reviewing security parameters

[Matt Summers <matt () pd9soft com>]

You add this attribute to the cookie in the HTTP response header.
http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp

Mozilla has plans to follow suit.
http://bugzilla.mozilla.org/show_bug.cgi?id=178993


Jared wrote:

> On Apr 16, 2004, at 3:01 PM, V. Poddubniy wrote:
>
> > Don't forget to set cookie as HttpOnly (this is useful at least for
> > users of IE 6 SP1). This will tell browser not to tell on-page scrips
> > (javascript, etc.) the cookie.
>
>
>     how does one do this? I was under the impression that you could 
> set a cookie to only be sent via HTTPS/SSL, but not with any other 
> restrictions.
>
>     Is this a feature that is unique to a particular web application 
> environment, i.e. ASP.Net, PHP, JSP?
>
> cheers,
>
> - Jared