4 ms·

> ... and the cookie API is horrible. What don't you like about it?

• austincheney 8y ago
  It is arguably worse than the Date api. https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie https://developer.mozilla.org/en-US/docs/Web/API/Document/co... Compare all that madness to the localStorage API: localStorage.myName = "string up to 5mb"; Attempting to delete a cookie makes me want to abandon coding. Removing from localStorage is as easy as: delete localStorage.myName;
  • asaph 8y ago
    The client-side API for cookies is irrelevant since it's disabled when the httponly flag is set on a cookie. And all cookies should have httponly set to true for security reasons. You should only be using server-side APIs for cookie management. Many good ones exist. Reference: https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly
    • austincheney 8y ago
      > You should only be using server-side APIs for coookie management. No. I will use any string I want of any size I want. Cookies are a relic of an archaic age for the web. Cookies only continue to be used because many server based web applications haven't figured out a modern way for managing sessions.
      • asaph 8y ago
        Storing arbitrary data in a cookie isn't a secure best-practice anyway. You shouldn't store actual data in cookies, just a meaningless token (aka session-id) that is used to look up session data on the server side. If you insist on using local storage, please be aware that it's unsuitable for storage of any sensitive data for the same security reasons that the httponly cookie flag exists. Don't let your API elegance preferences be the only factor in your architecture design choices. Please consider security too as you may be putting your users at risk. Design choices in this area are more nuanced than you seem to be aware of.