support for HttpOnly

[sdepold]

if i get that right, there is currently no way to set HttpOnly. Would be cool to have that. Here is some reading about it: http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html

[carhartl]

The idea of HttpOnly is to prevent cookies from being accessible through client-side code (that is document.cookie). AFAIK there is no way to write a cookie client-side that turns into a HttpOnly cookie afterwards.

[sdepold]

ah! ok that makes sense :)