How do I set the HttpOnly flag on a cookie in Ruby on Rails

Set the 'http_only' option in the hash used to set a cookie

e.g.

cookies["user_name"] = { :value => "david", :httponly => true }

or, in Rails 2:

e.g.

cookies["user_name"] = { :value => "david", :http_only => true }

Re Laurie's answer:

Note that the option was renamed from :http_only to :httponly (no underscore) at some point.

In actionpack 3.0.0, that is, Ruby on Rails 3, all references to :http_only are gone.

That threw me for a while.

Just set :http_only to true as described in the changelog.

I also wrote a patch that is included in Rails 2.2, which defaults the CookieStore session to be http_only.

Unfortunately session cookies are still by default regular cookies.