I guess, then, that the gist of this debate is: - If you get attacked in a way where the XSS would allow token exfiltration but are protected by HttpOnly, then

I guess, then, that the gist of this debate is: - If you get attacked in a way where the XSS would allow token exfiltration but are protected by HttpOnly, then the attacker is more likely to just grab data with your session cookie auth and POST that data over to their server using JS (or some other super-CSRF-like attack), so the HttpOnly limited the data you can protect to the token, which hardly matters at that point. Is that a more fair understanding of the issue? Thanks for the correction here!