massacring

public access it on a publicly accessible server, gives the public access to cookies "samesite" => "Strict" // Strict SameSite policy for better protection