I don't know of another way that reaches the same security model as secure httpOnly cookies, which are the recommended way to do session cookies.