Sorry, i think my first post was not clear enough.
The api is relying on the authorization header and the website on the cookie, i got the point.
What I wanted to say is that the cookie should be http_only and, because the authorization header is accessible from js, the value should be different as this value allow an attacker to impersonate a user.(by spoofing the cookie)
An attacker could send to a command and control server the value of "document.cookie" if an xss is found. He/she will be able to impersonate a user.
If the cookie is http_only, the value of "document.cookie" will not contain the session cookie value.
Because the authorization cookie must be available from js to query the api, the value should be different to avoid the attacker from retrieving the value and faking the session cookie.
Do you get the point ? Sorry if it's not clear enough. Im not english native.
