How do I set HttpOnly cookie in Django?

Question

And is it worth the effort to prevent XSS?

score 33 · Answer 1 · answered Jan 19 '11 at 15:52

33

Use

SESSION_COOKIE_HTTPONLY = True

in settings.py

answered Jan 19 '11 at 15:52

greg

This is not part of Django 1.2 (tho it does work in the dev. version of 1.3) – bsk Jan 24 '11 at 22:19
It has been `True` by default since 1.4. – gregoltsov Oct 20 '14 at 12:44
1

Documented at: https://docs.djangoproject.com/en/1.11/ref/settings/#std:setting-SESSION_COOKIE_HTTPONLY – Jim Munro Aug 07 '17 at 18:33
OP asked how to set an HttpOnly cookie in django, not necessarily how to have django manage the session cookie specifically. https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpResponse.set_cookie – kpup Jan 11 '21 at 21:28

score 7 · Answer 2 · answered Apr 04 '20 at 11:23

In Django 3.0 you can set the following cookies to True in your settings.py:

For instances, if

SESSION_COOKIE_HTTPONLY = True

Then your client-side JavaScript will not be able to access the session cookie.

score 6 · Accepted Answer · answered Aug 20 '10 at 09:38

6

SESSION_COOKIE_PATH = '/;HttpOnly'

answered Aug 20 '10 at 09:38

miku

I tried the JavaScript:alert(document.cookie); command after doing the above changes and I still get a full cookie shown within the alert. I restarted Apache as well as truncated the django_session table. No difference. Am I doing something wrong? – Rok Jan 10 '11 at 20:18
@Rok: Did you log out and/or clear the existing session cookie? – James Socol Feb 25 '11 at 14:51
4

New in Django 1.4 CSRF_COOKIE_SECURE = True will also make the csrf cookie secure, and available over https-only. – Priyeshj Feb 02 '12 at 18:04

3 Answers3