HTTPOnly sets cookie expiration to session

Question

I am writing a "Remember My Username" Cookie that expires in a custom duration of time e.g. one month. I noticed that when I add HttpOnly = true, the expiration changes to session. Why is this? I can't seem to find any documentation on why this would happen.

Thanks.

Answer 1

I'm adding the following code: Also, now I'm getting a different behaviors than the Title. I'm running this locally against the VS2010 built-in server. It seems to show inconsistent behaviors. I would move the HttpOnly = true before the Expires and after it and it seemed to change behavior until I refreshed the browser page. So, I am assuming everything was fine and never had an issue. In addition, I am moving HttpOnly and Secure flags to the web.config because not all my environments have SSL.

---

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket
                                                (strUserID, //name
                                                 false, //IsPersistent
                                                 24 * 60); // 24 hours

// Encrypt the ticket.
string encryTicket = FormsAuthentication.Encrypt(ticket);

// Create the cookie.
HttpCookie userCookie = new HttpCookie("Authentication", encryTicket);
userCookie.HttpOnly = true;
Response.Cookies.Add(userCookie);

e.Authenticated = true;
if (LoginPannelMain.RememberMeSet)
{
    HttpCookie aCookie = new HttpCookie("email", strUserLogin);
    aCookie.HttpOnly = true;
    aCookie.Expires = DateTime.Now.AddYears(1);
    Response.AppendCookie(aCookie);
}
else
{
    HttpCookie aCookie = new HttpCookie("email", "");
    aCookie.HttpOnly = true;
    Response.AppendCookie(aCookie);
}

Answer 2

Here is the documentation.

true if the cookie has the HttpOnly attribute and cannot be accessed through a client-side script; otherwise, false. The default is false.

Basically, it becomes a session variable because it will only be stored on the server due to your setting