What does the HttpOnly cookie attribute do?
It encrypts the cookie
It prevents JavaScript (document.cookie) from reading the cookie, which reduces the impact of XSS
It makes the cookie expire on browser close
It sends the cookie only over HTTP and never HTTPS