The problem with this approach is: It only protects cookies, not other sensitive data (as form content or local storage) It might not always be a viable solution when applied to a SPA - Singe Page Application as the JS layer may have to have access to the session cookie.