[wereHamster]

> While it’s possible to create cookie with credentials, this should be avoided due to all the possibilities of CSRF Attacks

This is no longer an issue, if you use SameSite=Strict, Secure, HttpOnly cookies.