HttpOnly

Are there any efforts underway to support the HttpOnly cookie directive 
within any version of the HTTP Protocol?

The HttpOnly cookie flag, now supported or soon to be supported by all 
major browser vendors, is a significant security enhancement for web 
centric computing. The HttpOnly flag simply prevents JavaScript from 
reading the details of a cookie. In particular, adding this flag to the 
HTTP spec as an /optional/ cookie directive will go a long way in 
assisting in the mitigation of Cross Site Scripting (XSS) and other 
session hijacking attack vectors.

With respect + Best Regards,
Jim Manico
jim.manico@aspectsecurity.com
Application Security Engineer + Web Application Architect