I am trying to build a headless cms and everything is going well until i need to interact with the frontend trying to make it secure, combine with the recent incomplete move away from the crosssite cookies.

At present my cms authenticates and stores a cookie, which came into with firefox.

however i am thinking of moving all my client authentication to the client, eg i return a header with the authentication info, and if the client supports cross site cookies it can set it.

But can i create https only secure partitioned cookie with a domain and path client side or does it have to be set by the server, eg i don’t want the client to have access to it after its been set.

I have read different things, so was just looking for clarity.

Thanks in advance.