What does HttpOnly do?

The answer

HttpOnly hides a cookie from page scripts, so document.cookie cannot read it, while the browser still sends it with requests. MDN notes it is still included on fetch and XMLHttpRequest calls. This limits cookie theft through cross-site scripting, because injected script cannot copy a session identifier. It does not stop injected script from acting as the user through requests that carry the cookie, so it reduces damage rather than preventing XSS. Preventing injection remains the real fix.