For a site that falls under PCI compliance scans you will need to have session cookies that have the httpOnly attribute set. With the release of the ColdFusion 9.0.1 release it is now much easier to have your session cookies to contain the httpOnly attribute.
Entries Tagged as 'Php'
Setting session cookies to have the httpOnly attribute with ColdFusion 9.0.1
Posted by John