Comment 7 for bug 96878

I wonder if you're aware that HttpOnly adds only very limited protections? If someone can run malicious script on your domain, then in most cases they can do just as much harm with HttpOnly cookies as without; it just requires a more complex attack. So this may "raise the bar" slightly, but doesn't add a lot of security; you're primarily relying upon avoiding XSS bugs in the first place.

Analysis and detailed justification:
http://www.gnucitizen.org/blog/why-httponly-wont-protect-you/