The HttpOnly flag ensures the web application cookie cannot be accessed by client side scripting running in the user’s browser.

Preventing client-side scripting from accessing cookie content may reduce the probability of a cross site scripting attack materializing into a successful session hijack.

---

1 – Open the web.config file for the site, application, or virtual directory you want to configure.

2 – Add the < httpCookies httpOnlyCookies=”true” /> tag within system.web tag.

< configuration>
< system.web>
< httpCookies httpOnlyCookies=”true” />
</ system.web>
</ configuration>

---