I'm wondering if anyone has real world experience implementing or moving from document.cookie to http only cookies? Or any stats on lost cookie coverage for iOS

I'm wondering if anyone has real world experience implementing or moving from document.cookie to http only cookies? Or any stats on lost cookie coverage for iOS devices? We're currently about to push an update to our system that uses a http only cookie on the shared 'action' domain and writes non-sensitive JWT to client domains for pre-fill and sending action data to CRM/ESP with document.cookie Now, I am leaning towards rethinking the client side and potentially just move everything to hosted subdomains so we can set http only JWT on client domains - would echo out a JS var with the user so JS can still access instead of document.cookie. Critically this JWT contains not login / donation / sensitive info I assume it's publicly accessible even though we dont have 3rd party JS outside of GA on these domains. I guess could just keep current setup with identity http only cookie on separate domain and just return JWT in a JSONP/cors request only send it back for 'verified' domains. But that seems hacky and adds http trips (and critically for pre-fill etc want it to be instant not flickered), though would be a lot easier than managing a bunch of subdomain cname stuff.