We need to protect Cookies from malicous Javascript. By setting HttpOnly...

... to true, cookies should only accessible by the server. This is a Security Best Practices.