The `has_js` cookie is set, to indicate JS is enabled, in `drupal.js` via:

    // 'js enabled' cookie.
    document.cookie = 'has_js=1; path=/';

The `HttpOnly` flag makes the cookie not available from JavaScript.
For that reason, it's not possible to set the `HttpOnly` flag when creating a cookie from JS. It may cause issues if there is JS, e.g contrib JS that checks for that cookie to determine if JS or cookie support is enabled.

The `Secure` flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JS support on non-HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the `HttpOnly` flag on the `has_js` cookie server side, by checking for that cookie and updating it to use the `HttpOnly` flag via the [`setcookie`][1] function.


  [1]: http://php.net/manual/en/function.setcookie.php