Article author here. > The article does a disservice to the reader by presenting HTTP cookies without mentioning sessions and how they are used to add state to

Article author here. > The article does a disservice to the reader by presenting HTTP cookies without mentioning sessions and how they are used to add state to a stateless request-reply protocol. Sessions are a thing that can be implemented using cookies, but isn't the effect of that covered by "credentials mean web content can be tailored for a particular user. It's how Twitter shows you _your_ feed, it's how your bank shows you _your_ accounts"? I feel that line covers it in a generic way, since you could implement the same thing using other state, like Authorization and TLS client certificates. Wouldn't throwing "sessions" in there be, as you'd say, buzzword bingo? It feels particularly confusing since that definition of session is different to "session storage" in the browser. > bundling TLS certificates in a topic involving CORS and HTTP cookies feels like a non-sequitur in the spirit of buzzword bingo It seems pretty relevant to me, as it's a defined part of credentials https://fetch.spec.whatwg.org/#credentials https://fetch.spec.whatwg.org/#credentials. If I didn't mention it, but mentioned the other two parts of credentials, I'm pretty sure someone would have 'well actually'd me over the missing information. Maybe you're confusing this with regular certs? I'm talking about TLS _client_ certificates specifically, which are often used as a credential for things like intranets.