Embedding content from one site to another like with an iframe, that requires cookie based credentialed login. As far as I’m aware, Cookies are still the safest

Embedding content from one site to another like with an iframe, that requires cookie based credentialed login. As far as I’m aware, Cookies are still the safest way to use session tokens and require the browser to keep those hidden from JS environments with http-only, reducing the risk of XSS attacks.