Use HttpOnly attribute for prohibiting access from JavaScript.

Author: xirc

app.py

@@ -6,7 +6,7 @@
 @app.route('/index/', methods=["GET"])
 def index():
     response = make_response("Here, take some cookie!")
-    response.headers["Set-Cookie"] = "my-first-cookie=some-cookie-value"
+    response.headers["Set-Cookie"] = "my-first-cookie=some-cookie-value; HttpOnly"
     return response