with http-only they can't _steal_ the cookie, but they can still _use_ the cooki...

		collinmanderson 12 days ago \| parent \| context \| favorite \| on: We pwned X, Vercel, Cursor, and Discord through a ... with http-only they can't _steal_ the cookie, but they can still _use_ the cookie. It reduces the impact but doesn't fully solve it.