title: SESSION_COOKIE_HTTPONLY = True not working in Django:
body: <p>I have set the following code in my <code>settings.py</code>:</p>
  
  <pre><code>SESSION_COOKIE_HTTPONLY = True
  </code></pre>
  
  <p>even though the <a href="https://docs.djangoproject.com/en/1.8/ref/settings/#std:setting-SESSION_COOKIE_HTTPONLY" rel="nofollow noreferrer">docs</a> say this is default.</p>
  
  <p>Then I use <code>./manage.py runserver</code> and run OWASP Zap scanner on the site. But OWASP zap says that the cookie was set without the HttpOnly flag:</p>
  
  <p><a href="https://i.stack.imgur.com/7VSse.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7VSse.png" alt="enter image description here"></a></p>
  
  <p>I also have this problem when I server the site with <code>gunicorn</code> and <code>nginx</code>. How can I get this flag set?</p>
  
  <p>Using <code>django 1.8</code>; the page <code>accounts/login</code> is managed by <code>django-registration-redux</code>, if that is relevant.</p>