Fix cookie behavior for remote functions

Describe the problem

Cookies set on a path other than the root path (/) are not sent (or not consistently sent) to remote functions, even if the requestEvent pathname matches the cookie's path. For example, let's say we have

• src/routes/xyz/data.remote.ts, with
  • a remote form that gets and sets a cookie named abc on the path /xyz (say to increment the stored value)
  • and a query that reads and returns the cookie data
• and src/routes/xyz/+page.svelte with the corresponding UI to show and increment the cookie

Assuming both the query and the form are called from that page, getRequestEvent().url.pathname will equal /xyz. In query this seems to work (not 100% sure about this, however.) But in the form function, the cookie is missing -- again, even though the event's pathname matches the cookie's path.

This is because the the request URL to the form is something like http://localhost:5173/_app/remote/i582ae/updateCookie. The path does not match the cookie path; so the browser does not send the cookie in the first place.

Here's a demo. The /bad and /good routes are exactly the same except for in /bad the cookie path is set /bad and in /good the cookie path is set to the root /.

I think I understand why Kit does this -- basically remote functions can be called from any route, so perhaps it's less than clear how to handle paths.

But it seems to be the case that event.url.pathname from getRequestEvent matches the pathname of the route where the request originated. So it's reasonable (I think) to expect a remote function called from /xyz to have access to the cookies set on /xyz. Setting cookies on paths other than the root is not an edge case that can be ignored. And it's not a great idea to stray from how RequestEvent behaves everywhere else.

Describe the proposed solution

1. Modify remote function URLs to start with the path of the originating route, so that the browser sends the cookies that match.

   Current: http://localhost:5173/_app/remote/i582ae/updateCookie

   New: Assuming the function is called from the page at /abc-originating-route, then (something like) http://localhost:5173/abc-originating-route/_remote/i582ae/updateCookie

   This seems doable.

2. Document the fact that the set of cookies available to a remote function is dependent on the route from which the function was called. So if you need to have a cookie available to a function, no matter where it's called from, then you should set the cookie path to /.

Note this would not be a regression from the current implementation, which already requires the cookie path to be / in order to work reliably. It still enables access to cookies at / from anywhere.

Alternatives considered

Don't use remote functions that rely on cookie paths other than /.

Importance

would make my life easier

Additional Information

No response

Start with the remote function example in src/routes/xyz/data.remote.ts and the corresponding src/routes/xyz/+page.svelte, then compare the browser request path with getRequestEvent().url.pathname using the linked demo. Done means path-scoped cookies are available when a remote function is called from a matching route, and the cookie-path behavior is documented.