How to set an HTTPONLY cookie in Flask

Question

I read Set "secure" attribute for Flask cookies, but it's for setting secure cookies, but I'm trying to set HTTPONLY cookies. They both are kind-of-secure cookies, but differ in specs (read more).

The cookie needs to be protected because it is about users' logging in information.

IamAshKS · Accepted Answer · 2019-12-15T18:26:13.930

11

Check set_cookie() (docs) under Flask APIs. It provides options for setting a HTTPONLY cookie using its httponly option. For example, the following code will set a HTTPONLY cookie:

set_cookie("name", value = "value", httponly = True)

edited Dec 15 '19 at 18:26

answered Nov 24 '19 at 04:20

IamAshKS

526
3
11

score 2 · Answer 2 · answered May 08 '20 at 00:05

2

Flask provides a configuration value SESSION_COOKIE_HTTPONLY which controls whether cookies are set to be http only. By default, however, it is set to True, so unless it's explicitly set to False, cookies will be http only.

answered May 08 '20 at 00:05

Razzi Abuissa

1,996
2
20
21

How to set an HTTPONLY cookie in Flask

2 Answers2