> by default should cookies only resolve to a single URL, and programmers have to whitelist subpaths? That sounds sensible! I always wondered why the origin an

> by default should cookies only resolve to a single URL, and programmers have to whitelist subpaths? That sounds sensible! I always wondered why the origin and cookie scope isn’t limited to the full URL of the resource that set it and only explicitly extendable by something like <link rel=“same-origin”...> Basically make every URL it’s own security and permissions sandbox but allow the programmer some latitude to extend it (and probably the administrator of parent directories/domains some capability to restrict how far up/across the tree a URL can reach, with the default perhaps being to allow only within same domain and path.)