Cookie scope should be narrower than the application boundary
A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.
A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.
The status line is the first contract a client reads.
A filename is only a hint; the response header is the browser-facing contract for the representation.