Yes. I got this realization during a study project where I investigated the use of secure cookies (was 2009, it's public [1]). It's just one example, but you c

Yes. I got this realization during a study project where I investigated the use of secure cookies (was 2009, it's public [1]). It's just one example, but you can find similar things everywhere. Sessions in Web applications are realized using cookies, which is not a very good way, because once someone manages to steal your cookie your session management is broken. And there are plenty of ways to do that, because there is no good separation of the session from the rest of the functionality. Because both cookies and sessions weren't in the design of http/html before, they were a later addon that. So was javascript. So were many other things. The thing you have to realize though: Things work. It's been the most successful technology of the past decades. There is no point in moaning that things would be much nicer if we'd redesign them from scratch, because it isn't going to happen. [1] https://blog.hboeck.de/archives/681-Study-research-project-about-session-cookies,-SSL-and-session-hijacking.html https://blog.hboeck.de/archives/681-Study-research-project-a...