Hacker News Reader

In the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.

Not for http-only cookies it doesn't.

No they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies