Cookie Domain is too broad
A cookie's Domain attribute is a leading-dot name with only two labels, which can cover a very wide suffix.
Why it matters
A broad Domain sends the cookie to more hosts than the one that set it.
What to do
Omit Domain for a host-only cookie, or set it to a deliberate parent you control.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.