title: Session Cookie without HttpOnly flag set
body: <p>I have joust built a website with a login system. After I've just got ready I have scanned it with Acunetix, but I got the following message:</p>
  
  <p>Session Cookie without HttpOnly flag set
  Session Cookie without Secure flag set (i guess this is only if I have SSL connection)</p>
  
  <p>So my question would be, that how can I set HttpOnly flag for all my Session data? I'm just using sessions when I log in the users. I'm giving them a session with their userID number and than I'm getting data using that userID.</p>
  
  <p>Is there any simple way that I can set ALL of the session HTTPOnly and secure them, so noone can touch them?</p>