There has been a - now defunct - working group which tried to address the issue of setting cookies on sub URIs: https://www.w3.org/TR/csp-cookies/ Particularly interesting is the proposal by someone from Akamai: https://lists.w3.org/Archives/Public/public-webappsec/2013Se... to include a path scope for cookies. I don't know if there are any more recent developments on cookies and their scope policies.