How do I modify the "has_js" cookie?

Question

I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review.

What are pros and cons of making the has_js cookie Http-only and Secure?

Answer 1

The has_js cookie is set, to indicate JavaScript is enabled, in drupal.js with the following code.

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';

The HttpOnly flag makes the cookie not available from JavaScript. For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JavaScript. It may cause issues if there is code that checks for that cookie to determine if JavaScript or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JavaScript support on non HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via setcookie().