Not necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid co

Not necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid code just as it would replace it with an auth cookie on success. A real attack would be through a programmatic request though. A captcha might help protect from that or you an use a redis instance or whatever to invalidate bad login cookies.