if the HttpOnly property is set in cookie (that is, the http you see is checked), then the cookie information will not be read through the js script, which can effectively prevent XSS attacks (the principle is that attackers enter (input) malicious HTML code to websites with XSS vulnerabilities, and this HTML code will be executed automatically when other users browse the site, thus achieving the purpose of the attack. For example, stealing user Cookie, destroying page structure, redirecting to other websites, etc.).