CSRF is really dead
Could we just avoid cookies altogether, and store session info in local storage?Sure it takes a bit of JS to pass the data as part of a request, but at least you're not prone to CSRF issues.I'm not sure there are many use cases where I really need cookies if I have local storage and JS available.