Cookie scope keeps the session where it belongs
A cookie’s host and path scope controls which destinations are eligible to receive its name and value. It is useful to minimize that set, but scope is not authorization, and cookies do not follow the browser’s full origin boundary. This article concentrates on Domain and Path; transport and request context add separate restrictions. ...