Consider the following, you have a web app on one domain, and marketing materials on one or more other domains. Some of those marketing materials are hosted by

Consider the following, you have a web app on one domain, and marketing materials on one or more other domains. Some of those marketing materials are hosted by a third party, or otherwise have less stringent security controls because the marketing pages don't have customer data. So you want to prevent some cookies, like the app authentication session cookie from being shared between the two sites (one reason for using different domains). As well as restricting the types of request marketing sites can make to the app. However, there is also state that you do want to share between the sites, like whether the user is logged in or not to show different links on marketing pages, or tracking the marketing pages the user has seen to give recommendations once they get to the product, or measure the effectiveness of a/b tests or pages at leading to registrations. If the domains are on seperate eTLDs, this is already a difficult situation, and will get even more difficult, possibly impossible with the disappearnce of third party cookies. If SOP was used for everything, it would make this difficult or impossible even if they were subdomains of the same eTLD+1. If anyone know of a good solution to this, I'd love to hear about it. The really annoying thing is that the server doesn't even need this shared state, but the SOP on localstorage and similar prevents using a local-only solution.