ini_set("session.cookie_httponly", 1);

session_start();
$params = session_get_cookie_params();
setcookie("PHPSESSID", session_id(), 0, $params["path"], $params["domain"],
    true  // this is the httpOnly flag you need to set
);