> httponly is not incredibly useful. If the attacker can run JavaScript on your page, you're in trouble. Gotta disagree with that. Defense in depth is always a

> httponly is not incredibly useful. If the attacker can run JavaScript on your page, you're in trouble. Gotta disagree with that. Defense in depth is always a good idea. Don't ignore a simple security win just because it isn't necessary if all of your other security measures are working. Security is needed the most when some of your security measures have already failed.