Is better set the cookie as secure using js-cookie or in server side?

[JulioCVaz]

First of all, congrats on this lib are so good.

I have a question about the secure flag.

If i set a cookie as secure like:

cookie.set('cookie', 'xyz', { secure: true })`

Another person will have obtains this cookie value from a not https request? I know that in theory not but I think that anyone can execute a script to modify your script javascript to set your cookie as secure: false, can obtain this value. I think...

Is it preferable to configure the cookie as secure on the server-side correct?