The HttpOnly flag can be set on a cookie returned from the server to stop it being accessed from JavaScript in the browser, helping to reduce the chance of cross-site scripting (XSS) attacks.
Always check the value of the IsHttpOnlyKnown property before using IsHttpOnly.