12 ms·
> You should only be using server-side APIs for coookie management. No. I will use any string I want of any size I want. Cookies are a relic of an archaic ag
by austincheney 8y ago
> You should only be using server-side APIs for coookie management.
No. I will use any string I want of any size I want. Cookies are a relic of an archaic age for the web.
Cookies only continue to be used because many server based web applications haven't figured out a modern way for managing sessions.
- asaph 8y agoStoring arbitrary data in a cookie isn't a secure best-practice anyway. You shouldn't store actual data in cookies, just a meaningless token (aka session-id) that is used to look up session data on the server side. If you insist on using local storage, please be aware that it's unsuitable for storage of any sensitive data for the same security reasons that the httponly cookie flag exists. Don't let your API elegance preferences be the only factor in your architecture design choices. Please consider security too as you may be putting your users at risk. Design choices in this area are more nuanced than you seem to be aware of.