The initial step to remedy this would be to determine whether any
client-side scripts (such as JavaScript) need to access the cookie and
if not, set the `HttpOnly` flag.

Additionally, it should be noted
that some older browsers are not compatible with the `HttpOnly` flag,
and therefore setting this flag will not protect those clients against
this form of attack.