How to set HttpOnly flag In Node.js ,Express.js application?

Question

Hi I have a project in node.js and I want to set the HttpOnly flag: true for header response.

I have written the following code in app.js but it make no effect in response header .

app.use(session({
 secret: "notagoodsecretnoreallydontusethisone",
 resave: false,
 saveUninitialized: true,
 cookie: {httpOnly: true, secure: true}
}));

因此，对于设置任何建议的HttpOnly标志中express.js深受欢迎。

Answer 1

我想你可以试试这个！

app.use(session({
   cookieName: 'sessionName',
   secret: "notagoodsecretnoreallydontusethisone",
   resave: false,
   saveUninitialized: true,
   httpOnly: true,  // dont let browser javascript access cookie ever
   secure: true, // only use cookie over https
   ephemeral: true // delete this cookie while browser close
}));