Consti

Not quite correct. For html, that is to signal standard compliance, you can leave it away and the browser will still handle it. For the bash one, all (most) shell scripts use .sh, so you need to give a shebang to tell the loader which executable (sh, bash, zsh, csh, …) to use

Also on Linux xdg does take file extensions into account, just executables do not

It’sintended to be used when the cookies are actually required for the app to work. For example, to preserve your login, you need a cookie, no way around. Unfortunately, as mentioned by others, it’s often abused