I work on Demandware platform, and use dw.web.Cookie class. there is no way to add HttpOnly attribute to the new Cookie.
Do we have any solution or workaround?
No, I'm afraid not. Per the documentation, Require HttpOnly atrribute: