I'm not sure what your comment adds and if I'm reading it right there is a lot of information that's just blatantly wrong I cant discuss your whole comment bec

I'm not sure what your comment adds and if I'm reading it right there is a lot of information that's just blatantly wrong I cant discuss your whole comment because it's long and I'm on a phone. "If you issue your auth cookies to .example.com and the / path don't be surprised why ever XSS and other client side attacks end up compromising your users, you can have 100 XSS's in your site, you can have a shitty CORS policy and if your cookies are issued and restricted properly it's more likely than not that those vuln's could not be leveraged to compromised your users' sessions (not through a classic session theft that is)." There is so much wrong about this paragraph. Who needs session theft in the scenario you provide.. If you have 100s of XSS on your site and a bad CORs policy there is a lot an attacker can do... Data exfiltration is very easy if you can execute js and so are things like XSRF. A correct path and domain setting for cookies is important but web security is a lot harder than your acting like it is..