Directly from AWS support for a ticket with exactly the same issue:
Kindly note that HTTPOnly flags are meant to protect cookies carrying sensitive information, and stop HTTP clients from sending this cookies in plain text (Secure) or to prevent XSS attacks / access to said cookie via client side scripts (HTTPOnly).
Currently HttpOnly flag are not supported by ALB , and there are two reason on why ALB isnt support it.
- Firstly, "AWSALB" cookies contains no sensitive data or does not contain usernames/passwords or any personal information and are only used to determine which backend to send requests to and the session information is not stored in the cookie.
- Secondly, the contents of the cookie sent by ALB both CLB are encrypted using a rotating key and only the AWS service has the private keys that are used to encrypt. Decryption or modification of load balancer-generated cookies is not supported. For more information regarding Sticky Sessions with ALB, please refer to the documentation .
---- Workaround ---
You can make use of a Classic Load Balancer (CLB) which supports both duration based and application based stickiness. AS stated in the documentation  "You can't set the secure flag or HttpOnly flag on your duration-based session stickiness cookies. However, these cookies contain no sensitive data. Note that if you set the secure flag or HttpOnly flag on an application-controlled session stickiness cookie, it is also set on the AWSELB cookie. "
Having said that, it is also worth mentioning that we do have an on-going feature request for it and I have tagged your case to it. Our internal team is aware of the requirement and is working on it. As you might already know, new features require immense troubleshooting and testing, therefore I would not be able to provide you with an ETA on the feature request. I would however recommend you to keep an eye on our AWS new and AWS blog pages  and  for information on it.
 Sticky sessions - https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-sticky-sessions.html
 Classic Load Balancer session sticky - https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-sticky-sessions.html