I second your question. The only downside of sending both cookies on each request is a bigger request size, which is not a bad trade-off for much simpler client

I second your question. The only downside of sending both cookies on each request is a bigger request size, which is not a bad trade-off for much simpler client (no service workers, everything is managed by cookie jar) Also, the approach with 2 cookies (statefull + stateless) is known for a long time. Eran Hammer (author of OAuth1 and OAuth2 specs) wrote about using this approach at Yahoo here: https://sideway.com/room/4Z https://sideway.com/room/4Z (search for Yahoo).