Yes, there are cases where you don't want HTTP ONLY or SECURE.
For the Secure cookie, I wouldn't expect any cookies to ever not have the secure attribute except for these two cases:
- development environments often don't have or need to have TLS certs (though maybe they should)
- to track activity that originated on http. You might even use your load balancer to set an insecure cookie before it sends back the redirect. Then your application analytics can track which URLs came in as HTTP.
In practice, if you're running an https site, always set the secure cookie, and if you don't know JS requirements, always error on the side with HTTPONLY set.
UPDATE TO ADDRESS COMMENTS
A lot of talk about whether you should or shouldn't use TLS in production. Posted the question here:
Should I develop with TLS on or off?