Well, you should be using `httpOnly` cookies (i.e. unusable from the browser) and setting them from the server. Your browser client will automatically send them.
document.cookie is a security vulnerability that's hard to find in any respectable documentation. It's up there with sql string concatenation.
document.cookie is a security vulnerability that's hard to find in any respectable documentation. It's up there with sql string concatenation.