Setting session cookie to HttpOnly
<p>I am developing an ASP.NET MVC server with Entity Framework 6.0. As far as I'm aware, it's set up to be compatible with EF 4.5 (<code>&lt;httpRuntime targetFramework="4.5" /&gt;</code>).</p>

<p>I want to ensure that the session cookie (ie. cookie that stores the session identifier) is HttpOnly, since that's an industry-wide best practice, which helps protect against Cross-Site Request Forgery attacks.</p>

<p>The problem is, it's created automatically by the framework, so I can't simply change an object's property right after calling the constructor, as is the case with all the other cookies.</p>

<p>In <code>Web.config</code>, I've set <code>&lt;httpCookies httpOnlyCookies="true" /&gt;</code>, and yet - when I retrieve the session cookie - it is <strong>not</strong> HttpOnly (its <a href="https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly(v=vs.110).aspx" rel="noreferrer">HttpCookie.HttpOnly</a> property is set <code>false</code>). And I don't quite know how to change that.</p>

<p>I couldn't find anything in Microsoft's documentation about <code>Web.config</code>'s <code>&lt;sessionState&gt;</code> that would change that. Here on Stack Overflow I only found <a href="https://stackoverflow.com/questions/2247143/how-is-httponly-get-set-for-asp-net-sessionid-cookie">a four year old question talking about how session cookie is HttpOnly by default</a>, which is <em>the precise opposite</em> for me, and <a href="https://stackoverflow.com/questions/39624162/why-asp-net-sessionid-cookie-by-default-is-not-httponly">a five days old question asking why session cookie is <strong>not</strong> HttpOnly by default</a> - which for some inexplicable reason was closed - without a comment - as a duplicate of the former.</p>

<p>I know <a href="https://stackoverflow.com/a/5978751/5282087">I can retrieve the session cookie, check it and set <code>HttpOnly=true</code> on every request</a> (or do that less often with a slightly more refined/hackish filter, or set it manually on login, or...), but <s>I'm not a blood-soaked barbarian</s> there has to be a proper way to do this.</p>

<p>So, how do I set the session cookie to HttpOnly?</p>