Agree but be sure to configure the cookie correctly. Set it to http-only, "secure" (only transmit over https) and set the domain/path correctly so only your server/application can see it.
This prevents cookies from being set at the root domain by a subdomain. Which in turn prevents non-TLS MITM cookie injection [1] as long as the application uses HSTS (even without includeSubdomains from the root).
[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
[1] https://www.usenix.org/conference/usenixsecurity15/technical...