cookie_https_only doesn't work when set to False about starsessions

[jrobbins-LiveData]

That's a good question. I went back to the test in question and I see that I misunderstood the requirement from starlette's TestClient. My test needed access to the session cookie on the client side, and I thought that I needed to remove httponly, but I see that all I needed to do was set cookie_https_only to False. I think the flag's name (cookie_https_only) had led me to believe that it would control the httponly attribute. But I see that my test works without the middleware I wrote to remove httponly, so this issue can be closed. Sorry about that!

[alex-oleshkevich]

This is correct. httponly forbids access to session cookie from JavaScript. Why do you want to disable this in tests?