I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review.

What are pros and cons of making the has_js cookie Http-only and Secure?

1 Answer 1


The has_js cookie is set, to indicate JavaScript is enabled, in drupal.js with the following code.

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JavaScript. It may cause issues if there is code that checks for that cookie to determine if JavaScript or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JavaScript support on non HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via setcookie().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.