How exactly do you configure httpOnlyCookies in ASP.NET?

If you're using ASP.NET 2.0 or greater, you can turn it on in the Web.config file. In the <system.web> section, add the following line:

<httpCookies httpOnlyCookies="true"/>

With props to Rick (second comment down in the blog post mentioned), here's the MSDN article on httpOnlyCookies.

Bottom line is that you just add the following section in your system.web section in your web.config:

<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />

If you want to do it in code, use the System.Web.HttpCookie.HttpOnly property.

This is directly from the MSDN docs:

// Create a new HttpCookie.HttpCookie myHttpCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());// By default, the HttpOnly property is set to false // unless specified otherwise in configuration.myHttpCookie.Name = "MyHttpCookie";Response.AppendCookie(myHttpCookie);// Show the name of the cookie.Response.Write(myHttpCookie.Name);// Create an HttpOnly cookie.HttpCookie myHttpOnlyCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());// Setting the HttpOnly value to true, makes// this cookie accessible only to ASP.NET.myHttpOnlyCookie.HttpOnly = true;myHttpOnlyCookie.Name = "MyHttpOnlyCookie";Response.AppendCookie(myHttpOnlyCookie);// Show the name of the HttpOnly cookie.Response.Write(myHttpOnlyCookie.Name);

Doing it in code allows you to selectively choose which cookies are HttpOnly and which are not.