2 ms·If something is a HttpOnly cookie, and I get XSS, why can't I just hit your API as much as I like anyway?by lvh 9y agoIf something is a HttpOnly cookie, and I get XSS, why can't I just hit your API as much as I like anyway?