Verifying the last pass found that two of its own corrections introduced fresh
errors. Removing a reference to an earlier draft left the Telegram sentence
circular, comparing a defect to a milder form of itself with no antecedent. And
the OAuth scope sentence attached its relative clause to the wrong thing, so it
read as though blocking-or-partitioning were the recommended recipe; those are
different facts, since the recipe drops AUTH_SAME_SITE=none and the callback
cookie then carries no attribute at all.
One correction had not been applied. The line saying AUTH_SAME_SITE=none adds an
unpartitioned HttpOnly JWT and contributes nothing was true of the engine the
cookie jar was read on and stated of all of them; Safari drops that pair
outright and Firefox delivers it either way, so it is dead weight on all three
for three different reasons.
Smaller: a configuration survives a browser setting instead of reaching it, the
Path B task list is above its cost paragraph and not below, Firefox never holds
a partitioned copy instead of not needing one, and the two remaining shorthand
mentions of XSS exposure now name the token exposure they mean.
Dmitry Verkhoturov
5045d69c20