// storage

what is Cookie round-trip and the HttpOnly boundary?

Whether a first-party cookie set on a response is echoed back on the next request proves the client keeps a persistent cookie jar. A known HttpOnly cookie readable from JS is impossible in a real browser, so a leak marks an instrumented/MITM client. Server-observable (round-trip) and client-observable (the HttpOnly leak) together.. Distilled from the richards storage-signals catalog (cookie group). Cross-ref: MDN Set-Cookie / Cookies guide.