The has_js cookie is set, to indicate JS is enabled, in drupal.js via:

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JS. It may cause issues if there is JS, e.g contrib JS that checks for that cookie to determine if JS or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JS support on non-HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via the setcookie function.

The has_js cookie is set, to indicate JavaScript is enabled, in drupal.js with the following code.

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JavaScript. It may cause issues if there is code that checks for that cookie to determine if JavaScript or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JavaScript support on non HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via setcookie().

The has_js cookie is set, to indicate JS is enabled, in drupal.js via:

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JS.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JS support on non-HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

You could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag.

The has_js cookie is set, to indicate JS is enabled, in drupal.js via:

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JS. It may cause issues if there is JS, e.g contrib JS that checks for that cookie to determine if JS or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JS support on non-HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via the setcookie function.