--- a/web/test/unittest_web.py	Fri Oct 17 18:16:58 2014 +0200
+++ b/web/test/unittest_web.py	Tue Jul 15 16:07:59 2014 +0200
@@ -117,6 +117,10 @@
         webreq = self.web_request('/%d' % admin_eid)
         self.assertEqual(webreq.status, 200)
 
+    def test_session_cookie_httponly(self):
+        webreq = self.web_request()
+        self.assertIn('HttpOnly', webreq.getheader('set-cookie'))
+
 
 class LogQueriesTC(CubicWebServerTC):
     @classmethod