How Amplify Auth and Cognito Hosted UI set cookie?

Thank you for very clear explanation, I understand that flow. I am still confused because two things.

1. After successfully logged in with the Cognito Hosted UI, I see the redirect_url with an appended code like: mydomain.amplify.com/?code=12345xxx => what does this mean? Does this mean mydomain.amplify.com will exchange the code for credentials (IdToken, AccessToken) and set credentials into my browser cookie?

2. The amplify configuration below. My web is NextJS. Does this mean that the Amplify JS code living inside web browser exchange the code for credentials and set credentials to cookie? If I remove cookieStorage setting, then the credentials will be stored in LocalStorage instead.

Amplify.configure({
    Auth: {
            cookieStorage: {
      // - Cookie domain (only required if cookieStorage is provided)
      domain: '.yourdomain.com',
      // (optional) - Cookie path
      path: '/',
      // (optional) - Cookie expiration in days
      expires: 365,
      // (optional) - See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
      sameSite: 'strict' | 'lax',
      // (optional) - Cookie secure flag
      // Either true or false, indicating if the cookie transmission requires a secure protocol (https).
      secure: true
    },
}
})

and client/browser call

  const user = await Auth.federatedSignIn({
              provider: CognitoHostedUIIdentityProvider.Cognito
            })