<p>Inspired by this CodingHorror article, "<a href="http://www.codinghorror.com/blog/archives/001167.html" rel="noreferrer">Protecting Your Cookies: HttpOnly</a>"</p>

<p>How do you set this property? Somewhere in the web config?</p>

With props to Rick (second comment down in the blog post mentioned), here's the
MSDN article
on httpOnlyCookies.
Bottom line is that you just add the following section in your system.web section in your web.config:
```
```
<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />
```
```