Normally any script running on your page can read your cookies. If an attacker manages to inject a script through an XSS bug, it can copy the session cookie and send it away, and they can then impersonate the user from their own machine.
Marking a cookie HttpOnly blocks that route. The browser keeps the cookie and attaches it to requests, but code on the page cannot see it. This does not stop XSS itself, and an injected script can still make requests as the user while the page is open, so it reduces the damage rather than removing the flaw.
Set HttpOnly on every cookie that JavaScript does not need to read, especially session cookies. Combine it with Secure and SameSite. Hand-written auth code from AI tools sometimes omits the flag, and tokens stored in local storage have no such protection at all.
Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Lax