5 ms·
I question that idea. Cookie is a standard header. So is Authorization. It's up to the server to require either. Basic auth header removes the need for a handsh
by virmundi 9y ago
I question that idea. Cookie is a standard header. So is Authorization. It's up to the server to require either. Basic auth header removes the need for a handshake to negotiate tokens. Authorization: Bearer (token) is now a standard. I suppose Cookie: (token) could be too, but too many people felt dirty.
My point is that Cookie does provide the credentials required for the call contex, this fulfilling the self containment requirement.
- sopooneo 9y agoAs I read it, the problem is not the mechanism by which a session is maintained, but the very existence of a session at all.