diff options
| author | Russell Keith-Magee <russell@keith-magee.com> | 2010-11-26 13:30:50 +0000 |
|---|---|---|
| committer | Russell Keith-Magee <russell@keith-magee.com> | 2010-11-26 13:30:50 +0000 |
| commit | 78be884ea788835ad98ad433862a82cf192c3d4f (patch) | |
| tree | 847a8e79b97f45de19f0c288e485a969237b3699 /docs/ref/settings.txt | |
| parent | ba21814583e5e3a4fafc4f5f34a26b6acdfb7590 (diff) | |
Fixed #3304 -- Added support for HTTPOnly cookies. Thanks to arvin for the suggestion, and rodolfo for the draft patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14707 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'docs/ref/settings.txt')
| -rw-r--r-- | docs/ref/settings.txt | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index b551a27093..3577ab0ceb 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -1392,6 +1392,25 @@ The domain to use for session cookies. Set this to a string such as ``".lawrence.com"`` for cross-domain cookies, or use ``None`` for a standard domain cookie. See the :doc:`/topics/http/sessions`. +.. setting:: SESSION_COOKIE_HTTPONLY + +SESSION_COOKIE_HTTPONLY +----------------------- + +Default: ``False`` + +Whether to use HTTPOnly flag on the session cookie. If this is set to +``True``, client-side JavaScript will not to be able to access the +session cookie. + +HTTPOnly_ is a flag included in a Set-Cookie HTTP response header. It +is not part of the RFC2109 standard for cookies, and it isn't honored +consistently by all browsers. However, when it is honored, it can be a +useful way to mitigate the risk of client side script accessing the +protected cookie data. + +.. _HTTPOnly: http://www.owasp.org/index.php/HTTPOnly + .. setting:: SESSION_COOKIE_NAME SESSION_COOKIE_NAME |