How to set a "safe" and "httponly" cookie in a tornado?

Question

I have a Tornado application that uses Google Oauth 2.0 authentication, receives an email and sets it to a cookie. Now I don’t want anyone else to access this cookie, copy the value and get other user information in my application. Therefore, I want to make this cookie httponlyand securecookie. However, when I pass these arguments, it cannot set the cookie:

self.set_secure_cookie('trakr', email, secure=True, httponly=True)

I sue Tornado 3.2.2 and Python 2.7.5.

since it cannot set a cookie, it redirects the google auth page. Here is my code:

class GAuthLoginHandler(BaseHandler, tornado.auth.GoogleOAuth2Mixin):
    @tornado.gen.coroutine
    def get(self):
        if self.get_current_user():
            self.redirect('/products')
            return

        if self.get_argument('code', False):
            user = yield self.get_authenticated_user(redirect_uri=settings.google_redirect_url,
                code=self.get_argument('code'))
            if not user:
                self.clear_all_cookies() 
                raise tornado.web.HTTPError(500, 'Google authentication failed')

            access_token = str(user['access_token'])
            http_client = self.get_auth_http_client()
            response =  yield http_client.fetch('https://www.googleapis.com/oauth2/v1/userinfo?access_token='+access_token)
            user = json.loads(response.body)
            self.set_secure_cookie('trakr', user['email'], secure=True, httponly=True)
            self.redirect(self.get_argument("next", "/products"))
            return

        elif self.get_secure_cookie('trakr'):
            self.redirect('/products')
            return

        else:
            yield self.authorize_redirect(
                redirect_uri=settings.google_redirect_url,
                client_id=self.settings['google_oauth']['key'],
                scope=['email'],
                response_type='code',
                extra_params={'approval_prompt': 'auto'})

, secure httponly. , httponly, , , cookie .

- ?

Answer 1

Tornado Python, , HTTPS:

cookie HTTPS, , cookie . . , cookie .