CSRF is really dead
Could we just avoid cookies altogether, and store session info in local storage?<p>Sure it takes a bit of JS to pass the data as part of a request, but at least you're not prone to CSRF issues.<p>I'm not sure there are many use cases where I really <i>need</i> cookies if I have local storage and JS available.