Route should have option to set arbitrary path other than root / path for cookie.

Customer security team consider it to be security vulnerability since cookie root path can be accesses by other app as well.

Every cookie created by an application and stored on the user's browser must have a path attribute. If the path attribute is set to / it means that the cookie is valid for all directories in the /path. If there were other applications configured in other parts of the application say /appl1 and/appl3 , this session cookie will be valid for both of those applications. This is irrespective of whether the user is authorized to use those applications or not. The impact is high as the user can gain unauthorized access to other critical applications

...