How exactly do you configure httpOnly Cookies in ASP Classic?

Question

I'm looking to implement httpOnly in my legacy ASP classic sites. Anyone knows how to do it?

Answer 1

You need to append ";HttpOnly" to the Response cookies collection.

Answer 2

Response.AddHeader "Set-Cookie", "mycookie=yo; HttpOnly"

Other options like expires, path and secure can be also added in this way. I don't know of any magical way to change your whole cookies collection, but I could be wrong about that.

Answer 3

Let me be the first to congratulate you on adding an excellent security feature to your cookies. Why more sites don't use the HttpOnly attribute, I'll never know...

Answer 4

HttpOnly does very little to improve the security of web applications. For one thing, it only works in IE (Firefox "supports" it, but still discloses cookies to Javascript in some situations). For another thing, it only prevents a "drive-by" attack against your application; it does nothing to keep a cross-site scripting attack from resetting passwords, changing email addresses, or placing orders.

Should you use it? Sure. It's not going to hurt you. But there are 10 things you should be sure you're doing before you start messing with HttpOnly.