I'm not sure why you're being downvoted, but I agree: cookies are enormous (bad) hack, and we knew they were an enormous hack when they were implemented many mo

I'm not sure why you're being downvoted, but I agree: cookies are enormous (bad) hack, and we knew they were an enormous hack when they were implemented many moons ago. I think it would be far better for HTTP to get a better auth system, and stop using cookies for auth, which would certainly mean it's far more fe. Also locking down session cookies to only get sent back to the host that generated them in the session would be excellent. It's highly unfortunate that this isn't fixed in HTTP/2, but it probably goes to show where the controlling powers interests lie.