Hacker News Reader

Right, but if you're doing a SPA, your SPA makes the login call and stores a copy of the session token in local storage, which unlike a cookie isn't automatically sent on any request, never mind cross-origin ones. Doesn't prevent against XSS of course, but then that's what CSP is for.

It's only necessary to store the login token if your backend is on a different origin than your SPA is served from. It's not especially hard to avoid this.

You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.