HTTPOnly ones cannot. This means that if both flags are set, they cannot be read - the flags are terribly named.
Secure is to do with transmission - they should only be sent over HTTPS connections - but it is possible to set
secure cookies from JS, and there isn't any specific expectation that they cannot be read by JS.
HTTPOnly is to do with client side access - they can't be viewed by JS, but can be sent over HTTP (and HTTPS - I have seen people claiming that they can only be sent over plain HTTP, which is not the case) connections for access by server-side scripts.
In many cases, both flags are set. In that case, the cookie will only be sent over HTTPS connections, and will be inaccessible by client side scripts.
What makes this more complicated is that cookies can have various parameters set, such as the
path attributes. If a cookie has the same name as a pre-existing cookie, but different values for any of these flags, a new cookie will be created. By the same token, if a cookie has a
domain attribute set, attempting to delete it without including the
domain attribute won't work - it deletes the non-existent cookie with the same name and no domain. Oh, and if you have the same domain and path for a
secure cookie, and attempt to overwrite it without setting the
secure flag, it doesn't create a new cookie, just removes the
secure flag and sets the new value - this is a bit counterintuitive given the domain/path behaviour.
In order to delete a cookie from JS, therefore, you need to ensure that you are addressing the correct cookie by both name and flag values, and that it doesn't have
HTTPOnly flag set, and that you're on a page with a HTTPS certificate. If any of these are not true, you won't be able to edit/delete it.