<p>I notice that Rails 2.2 (currently edge) supports <a href="http://rails.lighthouseapp.com/projects/8994/tickets/1046-http-only-cookies-in-cookiestore" rel="nofollow noreferrer">setting HttpOnly on the session cookie</a>.</p>

<p>Is there a way of setting it on a Rails 2.1 application without moving to edge/2.2?</p>

Set the
```
http_only
```
option to true in the cookie's options hash:
```
```
cookies['visits'] = { :value => '20', :http_only => true }
```
```