Scott posted a solution to support httpOnly cookies in ASP.NET 1.1 but pointed out some problems when you run the code on 2.0(http://www.hanselman.com/blog/HttpOnlyCookiesOnASPNET11.aspx)

Here is a solution:

protected void Application_EndRequest(Object sender, EventArgs e)
{
    if(System.Environment.Version.Major<2)
    {
        foreach(string cookie in Response.Cookies)
        {
            const string HTTPONLY = ";HttpOnly";
            string path = Response.Cookies[cookie].Path;
            if (path.EndsWith(HTTPONLY) == false)
            {
                //force HttpOnly to be added to the cookie
                Response.Cookies[cookie].Path += HTTPONLY;
            }
        }
    }
}