https://www.educative.io/courses/web-application-security-everyday-software-engineer/javascript-cant-touch-this
Learn how to protect HTTP cookies from JavaScript access using the HttpOnly flag to strengthen web app security against XSS attacks and session hijacking.
http cookiessecuringhttponlypreventxss