You mentioned that httpOnly cookie helped fight XSS attacks — is that correct? How?

HttpOnly cookie — is a special flag that can be set on a cookie to make it inaccessible to JavaScript in the browser. This helps combat XSS attacks because even if an attacker injects malicious script into the page, they cannot read or modify such cookies through document.cookie.

Thus, important session data or authentication tokens marked as HttpOnly are protected from theft via XSS. However, this does not prevent the XSS attack itself, but only limits the attacker's ability to access the cookie.