How can I modify the 'has_js' cookie?

Question

I am trying to modify the 'has_js' cookie that is set by Drupal. I need to modify this cookie so it becomes both Http-only and secure in response to a site security review.

I attempted to add the following to the html.tpl.php file so the cookie would be modified before any output was rendered:

setcookie('has_js',null,null,null,null,true,true);
setrawcookie('has_js',null,null,null,null,true,true);

This gave me 2 has_js cookies, one with the desired modifications and one without.

I next attempted to grab the value from the original has_js cookie and then destroy it and replace it:

if(isset($_COOKIE['has_js']))
{
  $has = $_COOKIE['has_js']; //save cookie's value (i.e., '1')
  unset($_COOKIE['has_js']);
  setcookie('has_js','',time()-3600); //destroy old cookie
  setcookie('has_js',$has,null,null,null,true,true);
  setrawcookie('has_js',$has,null,null,null,true,true);
}
else
{
  print_r("Not set");
}

This demonstrates (by the output I get) that at the start of html.tpl.php, the cookie isn't set -- which might explain why there are 2 cookies (perhaps I was creating a has_js cookie at one point in time and after that Drupal creates its own). Confusingly, if I simply do

print_r($_COOKIE); 

at the same place in the file, 'has_js' cookie does show up with an assigned value of 1.

So my question is:

How can I find out when Drupal is setting this 'has_js' cookie and how can I add these attributes to it?

Answer 1

I am answering this formally so other people can see one possible solution that will work if they have this same question, but the answer is actually found in the comment by @thumbson above: in order to modify the cookie, I did indeed find success in creating a custom js file that ran when every page loads.