Django SESSION_COOKIE_HTTPONLY set but the HttpOnly flag does not show up on cookies

Question

I've set this variable in the settings file like this:

SESSION_COOKIE_HTTPONLY = True

but when I open the website with Google Chrome HttpOnly does not show up in set-cookie.

My webserver is Apache2.4, and the website is using Https protocol.

Answer 1

I think what you are looking for is CSRF_COOKIE_HTTPONLY. Add it to your setting:

CSRF_COOKIE_HTTPONLY = True

PLease note that this will make sending AJAX requests a little harder. You will have to pull it from the page instead of getting it from the cookie.

Hope it helps!