I wonder if we need instead of a "big fat cookie jar" browsers should support authentication natively (i.e. they are aware that this is authentication, not that

I wonder if we need instead of a "big fat cookie jar" browsers should support authentication natively (i.e. they are aware that this is authentication, not that just there is some cookie called "session") and then we depreciate cookies entirely. Now that the auth headers are known about, they can be treated as such and expired based on user preferences, but by default after 24h. There can be an alert "google.com has logged you in and now knows who you are until you log out". Auth headers are then only sent for a single origin, so no scripts to track you around the web anyway. The cookie workaround for those that need to genuinely use them are 1. session feature mentioned above - tie to that on the server side and 2. stick something in the URL and then keep tracking that via links, like most SPAs do anyway. Want to do analytics? Anonymous-ish pixel or server logs. Local storage is another issue, that should be permission based. (+ any other dodgy web apis). Someone might say, what about a site you don't log into but needs to remember your prefence? A. Easy local storage, and it will ask for permissions AWS style e.g. "enter the name of the site to agree ____" Maybe get rid of UA string?