What does the HttpOnly cookie attribute do?

HttpOnly hides the cookie from scripts, so document.cookie can't read it. This limits the damage of XSS (an attacker's script running in your page).

"Sends the cookie only over HTTP" is the tempting wrong answer, because of the name. Sending only over HTTPS is the Secure attribute. Blocking cross-site requests is SameSite. A cookie is deleted when the browser closes if it has no Expires or Max-Age. That is a session cookie, not HttpOnly.