title: How to enable HttpOnly cookies on ASP.NET Core 2.1 Web site
body: <p>I have created a standard ASP.NET Core MVC website with Core 2.1 in Visual Studio using File->New Project.</p>
  
  <p>In the Startup.cs is the boilerplate code</p>
  
  <pre><code> public void ConfigureServices(IServiceCollection services)
      {
          services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
          {
              // This lambda determines whether user consent for non-essential cookies is needed for a given request.
              options.CheckConsentNeeded = context =&gt; true;
              options.MinimumSameSitePolicy = SameSiteMode.None;
          });
  
  
          services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
          else
          {
              app.UseExceptionHandler("/Home/Error");
              app.UseHsts();
          }
  
          app.UseHttpsRedirection();
          app.UseStaticFiles();
          app.UseCookiePolicy();
  
          app.UseMvc(routes =&gt;
          {
              routes.MapRoute(
                  name: "default",
                  template: "{controller=Home}/{action=Index}/{id?}");
          });
      }
  </code></pre>
  
  <p>When I browse the site there is a single .AspNet.Consent cookie when I accept the cookiepolicy. It is marked by default secure but not httponly.</p>
  
  <p>How to I enable HttpOnly on ALL cookies?</p>
  
  <p>Thanks.</p>