I am using Drupal 10 with the “EU Cookie Compliance” module.

My website audit asked me to add “secure” and “httponly” attributes to the “cookies-agreed” and “cookies-agreed-version” cookies.

I added the “secure” attribute in settings.php:

  if (isset($_COOKIE['cookie-agreed-version'])) {
    // MAJ le cookie 'cookie-agreed-version' avec l'attribut Secure
    setcookie('cookie-agreed-version', $_COOKIE['cookie-agreed-version'], null, '/', null, true, false);
  }
  if (isset($_COOKIE['cookie-agreed'])) {
    // MAJ le cookie 'cookie-agreed' avec l'attribut Secure.
    setcookie('cookie-agreed', $_COOKIE['cookie-agreed'], null, '/', null, true, false);
  }

but adding “httponly” (false to true )caused the cookie banner to malfunction: It keeps appearing every time I refresh the page or navigate, even after clicking “accept”.

How can I add the “httponly” attribute without affecting the cookie banner’s functionality?