Just curious as to what the broader context is behind your question...

Wouldn't below suffice since implicit testing of http-only and secure attributes are tested?

http {
server {
listen 443;
ssl on;
ssl_certificate ...;
ssl_certificate_key ...;

location / {
if ($cookie_COOKIE != '') {
echo "cookie found here is http-only and secure."
}
if ($cookie_YOURCOOKIE = '') {
return 404;
}
}
}
server {
listen 80;
location / {
return 404;
}
}

}