.NET中的Cookie设置HttpOnly，可以防止JS获取Cookie的值

HttpCookie myHttpCookie =
new HttpCookie("LastVisit",
DateTime.Now.ToString());

myHttpCookie.Name = "MyHttpCookie";
//中文编码，防止js获取的Cookie值是乱码，编码之后再解码就不会出现乱码，当然在实际中使用的时候是不需要编码的
//因为我们就是为了防止js获取Cookie的值，当然在低版本的IE（IE6以下）还是可以取得
myHttpCookie.Value = HttpUtility.UrlEncode("默认值");
Response.AppendCookie(myHttpCookie);

Response.Write(string.Format("{0}={1}", myHttpCookie.Name,
HttpUtility.UrlDecode(myHttpCookie.Value)));

//HttpOnly的Cookie
HttpCookie myHttpOnlyCookie =
new HttpCookie("LastVisit",
DateTime.Now.ToString());

myHttpOnlyCookie.HttpOnly = true;
myHttpOnlyCookie.Name = "MyHttpOnlyCookie";
myHttpOnlyCookie.Value = "Only值";
Response.AppendCookie(myHttpOnlyCookie);

Response.Write(string.Format("{0}={1}", myHttpOnlyCookie.Name, myHttpOnlyCookie.Value));

Js获取Cookie的值，看是否可以获取到，测试

function getCookie(name){
var arr = document.cookie.match(new RegExp("(^| )"+name+"=([^;]*)(;|$)"));
if(arr !=
null) return decodeURI(arr[2]);
return null;
}
alert(getCookie("MyHttpCookie"));//默认值
alert(getCookie("MyHttpOnlyCookie"));//null
// alert(document.cookie);

或直接在地址栏输入：javascript:alert(document.cookie);