Just to clarify, the PHPSESSID cookie was HttpOnly - I could extract the new value because I had overwritten it. Most of the cookies were set correctly (thankfully) however there was a lot of SPII stored in JS variables which I was able to get.

I've had arguments with people storing session tokens in local storage and claiming it is perfectly safe.

Not marking the cookie httpOnly ironically doesn't surprise me.

TLDR: if you aren't going to look up the very basics of security just use a trusted library