Navigation: Introduction to New Features > QPR Servers and Security
HttpOnly Flag Is Now Set for All Applicable Cookies (D-14586)
Previously only strictly session-related cookies had the HttpOnly flag. Now all cookies that do not need to be accessible from JavaScript code have the HttpOnly flag set.
