Too bad it's not reliably implemented cross browser. It's a great idea, though, so we go ahead and throw httponly onto every cookie we care about, even as we i

Too bad it's not reliably implemented cross browser. It's a great idea, though, so we go ahead and throw httponly onto every cookie we care about, even as we implement other measures. We had to hack together something, though, since Python's SimpleCookie class doesn't recognize httponly as a valid cookie attribute. edit: When he says he's not sure if Safari implements it or not, what he means to say is that Safari doesn't implement it. At all.