# About HTTP-only cookies in Ruby on rails **URL:** \ **Category:** Rails\ **Created:** [April 17, 2010, 12:50pm UTC](https://www.ruby-forum.com/t/about-http-only-cookies-in-ruby-on-rails/187116 "2010-04-17T12:50:34Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Yuchen\_Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@Yuchen\_Z](https://www.ruby-forum.com/u/Yuchen_Z)\ **Post date:** [April 17, 2010, 12:50pm UTC](https://www.ruby-forum.com/t/about-http-only-cookies-in-ruby-on-rails/187116/1 "2010-04-17T12:50:34Z")
Hi all, I am a security researcher at University of Virginia, I am currently doing research on HTTP-only cookie deployment. May I ask do ruby on rails support HTTP-only cookies, if yes, what is the default configuration for ruby on rails? In other words, do the HTTP servers need to set HTTP-only manually or it applies automatically? Many thanks in advance, Yuchen ---
**Author:** ![Yuchen\_Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@Yuchen\_Z](https://www.ruby-forum.com/u/Yuchen_Z)\ **Post date:** [April 17, 2010, 1:42pm UTC](https://www.ruby-forum.com/t/about-http-only-cookies-in-ruby-on-rails/187116/2 "2010-04-17T13:42:39Z")
On Apr 17, 7:54 am, Yuchen Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi all, > > I am a security researcher at University of Virginia, I am currently > doing research on HTTP-only cookie deployment. May I ask do ruby on > rails support HTTP-only cookies, if yes, what is the default > configuration for ruby on rails? In other words, do the HTTP servers > need to set HTTP-only manually or it applies automatically? Session cookies have been http-only by default for a while. If you create extra cookies by yourself then it’s up to you to decide whether you want them http-only or not. Fred