http://blog.modsecurity.org/2008/12/helping-protect-cookies-with-httponly-flag.html

http://www.icto.jp/security_report/pdf/sr20080310.pdf

http://www.dbsj.org/Japanese/Archives/dbjapan/auto/2008/msg00290.html