I stand corrected.

With a little reflection I should have guessed that the HTTP request- and response-parameters are involved. This is proof of the harm that Web-application-frameworks do to a developer's brain. 10 years after and I have still not recovered.

You should be using uMatrix instead of NoScript, then you'd see that cookies are not dependent on javascript.
No offense, but a sentence like "PHP will most certainly create the JavaScript which is shipped along with the generated HTML" is nonsense.
Plenty web pages come completely without javascript, plenty PHP that does not create any javascript at all.
PHP creates the page - and, if so configured, the cookie - in the moment it is requested from the client.
It is server side scripting. Do you know the difference between that and client-side scripting (e.g. javascript)?

Sounds like a case of people in charge having no clue about how the internet works, resulting in completely blue-eyed outsourcing.

Always disable Third-Party Cookies - they have no value to you, whilst allowing malicious entities to spy on your activities and interests.

uMatrix and/or Privacy Badger both make it easy to conditionally allow such cookies when you're dealing with websites written by incompetent developers.

1 members found this post helpful.

As I had ignored the possibility to include all key/value pairs in request- and response, my misunderstanding was much heavier than that. But the resolution is also simpler.

Cookies can't infect computers with viruses or other malware. However, some cyberattacks can hijack cookies and enable access to your browsing sessions.

1 members found this post helpful.

Cyberattacks, he?

You should care about who sets a cookie on which site (and why in hell, as they have nothing in common) and to what purpose. If you cannot find the answer, it is probably best to disable cookies.

If you disable cookies in most web browsers then some pages wont load. More and more cloudflare sites are like that. I've tried to load pages that post "Go Away" if you don't have scripts and cookies enabled. That's because you are keeping them from making money.

I even had one the other day that curl would not get the source for. But it would load in a browser with cookies enabled.

1 members found this post helpful.

Disabling third-party cookies only causes issues in rare situations, (and can be used as an indicator of how much you should/shouldn't trust a website/company - and again, uMatrix and/or Privacy Badger are useful tools for dealing with those situations).

Any site that wants search engines to spider them cannot stop people accessing it - because any blocks they put in place can be bypassed by making oneself look like a bot.

My line was:
PSE cite me correctly or do not cite me. TY.

Fully agree: a whitelist approach is the safest and sanest thing to do when browsing the WWW of 2020...