diff --git a/django/conf/global_settings.py b/django/conf/global_settings.py
index a86adf8..3f0b5f1 100644
--- a/django/conf/global_settings.py
+++ b/django/conf/global_settings.py
@@ -316,6 +316,7 @@ SESSION_COOKIE_NAME = 'sessionid'                       # Cookie name. This can
 SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 2               # Age of cookie, in seconds (default: 2 weeks).
 SESSION_COOKIE_DOMAIN = None                            # A string like ".lawrence.com", or None for standard domain cookie.
 SESSION_COOKIE_SECURE = False                           # Whether the session cookie should be secure (https:// only).
+SESSION_COOKIE_HTTP_ONLY = False                        # Whether the session cookie should be flagged HTTPOnly (not visible to JavaScript in the web browser)
 SESSION_COOKIE_PATH = '/'                               # The path of the session cookie.
 SESSION_SAVE_EVERY_REQUEST = False                      # Whether to save the session data on every request.
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False                 # Whether a user's session cookie expires when the Web browser is closed.
diff --git a/django/contrib/sessions/middleware.py b/django/contrib/sessions/middleware.py
index 57fcb90..86e5650 100644
--- a/django/contrib/sessions/middleware.py
+++ b/django/contrib/sessions/middleware.py
@@ -38,5 +38,6 @@ class SessionMiddleware(object):
                         request.session.session_key, max_age=max_age,
                         expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
                         path=settings.SESSION_COOKIE_PATH,
-                        secure=settings.SESSION_COOKIE_SECURE or None)
+                        secure=settings.SESSION_COOKIE_SECURE or None,
+                        http_only=settings.SESSION_COOKIE_HTTP_ONLY or None)
         return response
diff --git a/django/http/__init__.py b/django/http/__init__.py
index 7c6b8f9..3e1e89d 100644
--- a/django/http/__init__.py
+++ b/django/http/__init__.py
@@ -336,7 +336,7 @@ class HttpResponse(object):
         return self._headers.get(header.lower(), (None, alternate))[1]
 
     def set_cookie(self, key, value='', max_age=None, expires=None, path='/',
-                   domain=None, secure=False):
+                   domain=None, secure=False, http_only=False):
         self.cookies[key] = value
         if max_age is not None:
             self.cookies[key]['max-age'] = max_age
@@ -348,6 +348,8 @@ class HttpResponse(object):
             self.cookies[key]['domain'] = domain
         if secure:
             self.cookies[key]['secure'] = True
+        if http_only:
+            self.cookies[key]['HTTPOnly'] = True
 
     def delete_cookie(self, key, path='/', domain=None):
         self.set_cookie(key, max_age=0, path=path, domain=domain,
diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt
index 6b29b3b..74218ab 100644
--- a/docs/ref/request-response.txt
+++ b/docs/ref/request-response.txt
@@ -509,7 +509,7 @@ Methods
     Returns ``True`` or ``False`` based on a case-insensitive check for a
     header with the given name.
 
-.. method:: HttpResponse.set_cookie(key, value='', max_age=None, expires=None, path='/', domain=None, secure=None)
+.. method:: HttpResponse.set_cookie(key, value='', max_age=None, expires=None, path='/', domain=None, secure=None, http_only=None)
 
     Sets a cookie. The parameters are the same as in the `cookie Morsel`_
     object in the Python standard library.
@@ -523,8 +523,12 @@ Methods
           the domains www.lawrence.com, blogs.lawrence.com and
           calendars.lawrence.com. Otherwise, a cookie will only be readable by
           the domain that set it.
+        * Use ``http_only`` if you want the cookie to be hidden from JavaScript
+          on the web browser. Support for `HTTPOnly`_ dates back to 2002. Although
+          it isn't completely foolproof, it does make attacks harder to implement.
 
     .. _`cookie Morsel`: http://docs.python.org/library/cookie.html#Cookie.Morsel
+    .. _`HTTPOnly`: http://www.owasp.org/index.php/HTTPOnly
 
 .. method:: HttpResponse.delete_cookie(key, path='/', domain=None)
 
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index e631909..095c097 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -942,6 +942,19 @@ Whether to use a secure cookie for the session cookie. If this is set to
 ensure that the cookie is only sent under an HTTPS connection.
 See the :ref:`topics-http-sessions`.
 
+.. setting:: SESSION_COOKIE_HTTP_ONLY
+
+SESSION_COOKIE_HTTP_ONLY
+------------------------
+
+Default: ``False``
+
+Whether to hide the session cookie from JavaScript in most browsers. The
+cookie can still be read in some browsers, but does provide an improved level
+of security.
+
+.. _HTTPOnly cookies: http://www.owasp.org/index.php/HTTPOnly
+
 .. setting:: SESSION_EXPIRE_AT_BROWSER_CLOSE
 
 SESSION_EXPIRE_AT_BROWSER_CLOSE
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt
index a81f536..4c8aef6 100644
--- a/docs/topics/http/sessions.txt
+++ b/docs/topics/http/sessions.txt
@@ -459,6 +459,17 @@ Whether to use a secure cookie for the session cookie. If this is set to
 ``True``, the cookie will be marked as "secure," which means browsers may
 ensure that the cookie is only sent under an HTTPS connection.
 
+SESSION_COOKIE_HTTP_ONLY
+------------------------
+
+Default: ``False``
+
+Whether to hide the session cookie from JavaScript in most browsers. The
+cookie can still be read in some browsers, but does provide an improved level
+of security.
+
+.. _HTTPOnly cookies: http://www.owasp.org/index.php/HTTPOnly
+
 SESSION_EXPIRE_AT_BROWSER_CLOSE
 -------------------------------
 
diff --git a/tests/modeltests/httpresponse/__init__.py b/tests/modeltests/httpresponse/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/tests/modeltests/httpresponse/models.py b/tests/modeltests/httpresponse/models.py
new file mode 100644
index 0000000..e69de29
diff --git a/tests/modeltests/httpresponse/tests.py b/tests/modeltests/httpresponse/tests.py
new file mode 100644
index 0000000..7703941
--- /dev/null
+++ b/tests/modeltests/httpresponse/tests.py
@@ -0,0 +1,23 @@
+__test__ = {'API_TESTS':"""
+>>> r = HttpResponse()
+>>> r.set_cookie("aaa","AaA",path="/somewhere")
+>>> r.cookies.output()
+'Set-Cookie: aaa=AaA; Path=/somewhere'
+>>> r.set_cookie("aaa","AaA",domain="test.com",path="/somewhere")
+>>> r.cookies.output()
+'Set-Cookie: aaa=AaA; Domain=test.com; Path=/somewhere'
+>>> r.set_cookie("aaa","AaA",path="/somewhere",domain="test.com",max_age=10000,expires="Mdy, 01-Jan-2038 00:00:00 GMT",secure=True,http_only=True)
+>>> r.cookies.output()
+'Set-Cookie: aaa=AaA; Domain=test.com; expires=Mdy, 01-Jan-2038 00:00:00 GMT; httponly; Max-Age=10000; Path=/somewhere; secure'
+>>> r.cookies.clear()
+>>> r.delete_cookie("bbb",domain="test.com",path="/")
+>>> r.cookies.output()
+'Set-Cookie: bbb=; Domain=test.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/'
+
+"""}
+
+from django.http import HttpResponse
+
+if __name__ == "__main__":
+    import doctest
+    doctest.testmod()
