diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js
index 033d7995c9c..84d3234d8ba 100644
--- a/addons/web/static/src/js/core/session.js
+++ b/addons/web/static/src/js/core/session.js
@@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             }).always(function () {
                 self.avoid_recursion = false;
             });
-        } else {
-            // normal use case, just use the cookie
-            self.session_id = utils.get_cookie("session_id");
-            return $.when();
         }
+        return $.when();
     },
     /**
      * Executes an RPC call, registering the provided callbacks.
diff --git a/odoo/http.py b/odoo/http.py
index 14dfc6c89f5..e0ffe58c4c7 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -1420,7 +1420,8 @@ class Root(object):
         #   (the one using the cookie). That is a special feature of the Session Javascript class.
         # - It could allow session fixation attacks.
         if not explicit_session and hasattr(response, 'set_cookie'):
-            response.set_cookie('session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60)
+            response.set_cookie(
+                'session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60, httponly=True)
 
         return response