If the server supports the HTTP TRACE verb you can still get the cookie. It would be rare, but possible non the less.