> If you are sharing an authentication token with the browser, cookie or not, it can be read by any scripts on the same origin. No, it can't. Read about http-o

> If you are sharing an authentication token with the browser, cookie or not, it can be read by any scripts on the same origin. No, it can't. Read about http-only cookies.