Protecting Your Cookies: HttpOnly

Keppla, I came here to say the same thing - while this definitely does negate cookie theft, it does -not- negate the dangers of XSS as a rule.

There are many more things that XSS will open up as a vulnerability to your users.

This trick, while definitely useful, is treating the symptom and not the disease.