The HttpOnly flag was introduced for XSS attack mitigation. Cookies without this flag can be set and read using JavaScript client-side scripts. This means that if a web application has an XSS vulnerability, an attacker could potentially steal sensitive cookies. Whenever you specify HttpOnly, the browser will send cookies with this flag only in response to HTTP requests.
Learn more about cross-site scripting (XSS) vulnerabilities.