如何在 Ruby on Rails 中的 cookie 上设置 HttpOnly 标志

问题描述：

页面保护您的 Cookie:HttpOnly解释了为什么制作 HttpOnly cookie 是个好主意.

The page Protecting Your Cookies: HttpOnly explains why making HttpOnly cookies is a good idea.

如何在 Ruby on Rails 中设置此属性?

How do I set this property in Ruby on Rails?

答

在用于设置 cookie 的哈希中设置 'http_only' 选项

Set the 'http_only' option in the hash used to set a cookie

例如

cookies["user_name"] = { :value => "david", :httponly => true }

或者，在 Rails 2 中:

or, in Rails 2:

例如

cookies["user_name"] = { :value => "david", :http_only => true }