Is it safe to store “devise-jwt” token in cookie without httpOnly?

Question

I have a React SPA connecting to a Rails API and I am using devise-jwt for authentication. Currently I am saving the token in cookies and I manually add them to every reques