Cookie scope keeps the session where it belongs
A cookie’s scope is the set of requests that carry it. Domain, Path, Secure and SameSite each remove requests from that set, and the browser applies all of them before writing a Cookie header. Scope is the cheapest control in a web stack: free at request time, and it shrinks how often a session token crosses a network you do not own. ...