How do I set HttpOnly cookie in Django?

Use

SESSION_COOKIE_HTTPONLY = True

in settings.py

In Django 3.0 you can set the following cookies to True in your settings.py:

• LANGUAGE_COOKIE_HTTPONLY
• SESSION_COOKIE_HTTPONLY
• CSRF_COOKIE_HTTPONLY

For instances, if

SESSION_COOKIE_HTTPONLY = True

Then your client-side JavaScript will not be able to access the session cookie.