diff options
Diffstat (limited to 'docs/topics/http')
| -rw-r--r-- | docs/topics/http/sessions.txt | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt index 8a0f0d4b72..dd48c72a23 100644 --- a/docs/topics/http/sessions.txt +++ b/docs/topics/http/sessions.txt @@ -457,6 +457,23 @@ The domain to use for session cookies. Set this to a string such as ``".lawrence.com"`` (note the leading dot!) for cross-domain cookies, or use ``None`` for a standard domain cookie. +SESSION_COOKIE_HTTPONLY +----------------------- + +Default: ``False`` + +Whether to use HTTPOnly flag on the session cookie. If this is set to +``True``, client-side JavaScript will not to be able to access the +session cookie. + +HTTPOnly_ is a flag included in a Set-Cookie HTTP response header. It +is not part of the RFC2109 standard for cookies, and it isn't honored +consistently by all browsers. However, when it is honored, it can be a +useful way to mitigate the risk of client side script accessing the +protected cookie data. + +.. _HTTPOnly: http://www.owasp.org/index.php/HTTPOnly + SESSION_COOKIE_NAME ------------------- |