Indy TidHttpServer Set Cookie to HTTPONLY?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
snorkel · 2019-11-26 16:50

Hi,
is it possible to set the tidhttpserver so the session cookie has
httponly?
I see idcookie has options for it but it's not exposed anywhere in the
server component.

----------------------------------------------------------------------
Remy Lebeau · 2019-11-27 18:57

Quote from: snorkel on November 26, 2019, 05:50:41 pmis it possible to
set the tidhttpserver so the session cookie has httponly?

That option is not implemented in TIdHTTPServer itself.

However, in the OnCommand... events, if AResponseInfo.Session is not
nil then you should be able to manually find a cookie in the
AResponseInfo.Cookies collection whose CookieName matches
TIdHTTPServer.SessionIDCookieName and Value matches
AResponseInfo.Session.SessionID, and if found then set its HttpOnly
(or any other property) as needed.