如何在 Node.js,Express.js 应用程序中设置 HttpOnly 标志？

Question

Hi I have a project in node.js and I want to set the HttpOnly flag: true for header response.

I have written the following code in app.js but it make no effect in response header.

app.use(session({
 secret: "notagoodsecretnoreallydontusethisone",
 resave: false,
 saveUninitialized: true,
 cookie: {httpOnly: true, secure: true}
}));

So any suggestion for setting HttpOnly Flag in express.js is most welcome.

Answer 1

I think you could try this!

app.use(session({
   cookieName: 'sessionName',
   secret: "notagoodsecretnoreallydontusethisone",
   resave: false,
   saveUninitialized: true,
   httpOnly: true,  // dont let browser javascript access cookie ever
   secure: true, // only use cookie over https
   ephemeral: true // delete this cookie while browser close
}));

Answer 2

This example uses cookie-parser library.

Setting a cookie: res.cookie("cookie_name", token, {})

Pass res.cookie() an options object with httpOnly: true ,

 const options = {
    expires: duration,
    httpOnly: true,
  };

Final eg

res.cookie("cookie_name", token, options)

• https://www.npmjs.com/package/cookie-parser
• https://expressjs.com/en/resources/middleware/cookie-parser.html