I think it came from misunderstanding a lot of things by people making SPAs... Session cookie is invisible to JavaScript, so handling unauthenticated state is

I think it came from misunderstanding a lot of things by people making SPAs... Session cookie is invisible to JavaScript, so handling unauthenticated state is a bit weird. Bearer token is visible to JavaScript, so SPA can make some assumption about authentication status. However, it still must handle 401s because token could have been revoked or expired (JWT solves the expired problem). You also could encode some metadata like username and email and instead of having a single round-trip to fetch it once, now you will be sending kilobytes of cookies with every request. CORS is a black magic to them. How to properly set cookie is also back magic - who would know that you can set cookie in way that would include subdomains, so it will be sent to www.acme.org AND to api.acme.org. It was also weird to set a session cookie on outgoing requests when service a talks to service b.