HTTPOnly sets cookie expiration to session

Question

I am writing a "Remember My Username" Cookie that expires in a custom duration of time e.g. one month. I noticed that when I add HttpOnly = true, the expiration changes to session. Why is this? I can't seem to find any documentation on why this would happen.

Thanks.

Welcome to Stack Overflow. Please keep in mind that appreciation is shown through upvotes and accepted answers. I highly suggest all new users to peruse the [faq], especially the [ask] :) — Justin Pihony, Mar 10 '12 at 19:41
Can you show us the code that you're using to set and read the cookie? — LukeH, Mar 10 '12 at 22:47

score 2 · Answer 1 · answered Mar 10 '12 at 19:30

Here is the documentation.

true if the cookie has the HttpOnly attribute and cannot be accessed through a client-side script; otherwise, false. The default is false.

Basically, it becomes a session variable because it will only be stored on the server due to your setting

score 0 · Accepted Answer · edited Jun 13 '13 at 21:29

I'm adding the following code: Also, now I'm getting a different behaviors than the Title. I'm running this locally against the VS2010 built-in server. It seems to show inconsistent behaviors. I would move the HttpOnly = true before the Expires and after it and it seemed to change behavior until I refreshed the browser page. So, I am assuming everything was fine and never had an issue. In addition, I am moving HttpOnly and Secure flags to the web.config because not all my environments have SSL.

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket
                                                (strUserID, //name
                                                 false, //IsPersistent
                                                 24 * 60); // 24 hours

// Encrypt the ticket.
string encryTicket = FormsAuthentication.Encrypt(ticket);

// Create the cookie.
HttpCookie userCookie = new HttpCookie("Authentication", encryTicket);
userCookie.HttpOnly = true;
Response.Cookies.Add(userCookie);

e.Authenticated = true;
if (LoginPannelMain.RememberMeSet)
{
    HttpCookie aCookie = new HttpCookie("email", strUserLogin);
    aCookie.HttpOnly = true;
    aCookie.Expires = DateTime.Now.AddYears(1);
    Response.AppendCookie(aCookie);
}
else
{
    HttpCookie aCookie = new HttpCookie("email", "");
    aCookie.HttpOnly = true;
    Response.AppendCookie(aCookie);
}

I figured out that I didn't check the checkbox, which in the code has the expires code which was causing my original question. — evodev, Mar 13 '12 at 23:45

HTTPOnly sets cookie expiration to session

2 Answers2