If a cookie (auth cookie in particular) has
httpOnly attribute set, does
sameSite attribute add any other layer of security?
From my understanding,
sameSite is used to prevent CSRF, but
httpOnly mitigates that, no?
Only thing I can think of is that the server would drop the
sameSite cookie if the attacker got hold of it and sent it to the server from a different domain (not sure what use that would have).