We need to protect Cookies from malicous Javascript. By setting HttpOnly to true, cookies should only accessible by the server. This is a Security Best Practices.