What is the concept of saving session id in cookie?

I am developing a secured website for an enterprise . I want it to be perfectly secured from all known vulnerabilities. I came across creating secure cookies and enabling HTTPOnly but in that example they were using cookie value being a sesssion Id. I didn't understand. Would not using this way can be a threat?