5 ms·

So you mean, why use a simple solution when a newer, more complex solution is available?

by goto11 7y ago

austincheney 7y ago
Aside from their APIs they are both of equal complexity. Cookies have a far more complex API. https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie https://developer.mozilla.org/en-US/docs/Web/API/Document/co... https://en.m.wikipedia.org/wiki/Complexity https://en.m.wikipedia.org/wiki/Complexity Perhaps you instead meant to use the word challenging, which is subjective depending upon who you ask.
- goto11 7y ago
  But you don't even need to use the API to use cookies. You set them on the server, and the browser send them back. It works entirely without any JavaScript.
  - austincheney 7y ago
    I already addressed that in the link in my original comment. https://news.ycombinator.com/item?id=23098196 https://news.ycombinator.com/item?id=23098196
- ComputerGuru 7y ago
  I’m guessing you’re a frontend guy. The two are only comparable from the frontend, if you’re developing a traditional app and want to use LS instead of cookies, it is certainly embarrassingly more complex as you’re forced into a JS intermediary to channel info between LS and your backend. So, no, certainly not equal complexity.
  - austincheney 7y ago
    I am a fullstack developer. It is the same level of complexity because there is an intermediary either way. Web servers do provide authentication capabilities, but commercial web servers have not relied upon that since the late 90s / early 00s. Most web servers use something equivalent to Spring MVC to maintain both authentication and session management largely because the authentication capability supplied by the web server are only there to protect access to the server and thus directly doesn't account for most common security considerations, example OWASP Top 10. Authentication and session management across a network can be accomplished across a variety of ways. Operating systems prefer Kerberos for remote authentication. Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. The same end result, authentication and session management, can be accomplished with the same complexity without cookies. Complexity refers to the number of steps involved and not the challenge imposed upon the developer. https://en.wikipedia.org/wiki/Complexity https://en.wikipedia.org/wiki/Complexity The only reason to prefer an out-dated functionally obsolete technology is fear of disruption. I have explained all this already, please see the comment I linked to from above: https://news.ycombinator.com/item?id=23098196 https://news.ycombinator.com/item?id=23098196
    - goto11 7y ago
      > Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. You seem to believe that developers should always chose the most complex and intricate solution possible, and the only reason someone would chose a simpler solution would be due to incompetence or ignorance of the more complex solution. This is completely opposite of all good engineering practice. Complexity is not a goal, it is a liability. You want to have the minimum amount of complexity which solves the problem.
      - austincheney 7y ago
        I have defined complexity for you several times. Complexity is not hard just as simplicity is not easy. Just because some framework running on the server hides the challenges from you does not mean the complexity is lower. The complexity is dictated by the business requirements (the problem state).
        ComputerGuru 7y ago
        You’re not getting it. You don’t need any intermediary framework or library to store state in cookies from the backend. You can do it without executing anything on the client. With LS, you are forced architecturally to execute code on the backend and in the browser just to accomplish the same thing. They’re incomparable.
        goto11 7y ago
        Consider when you are visiting a page where you have been before, and you have received some identifier token. Using cookies, the browser automatically sends the identifier token along with the initial request, and the server can serve the initial response based on your identity. With localStorage, the browser initially send an anonymous request to the server, the server then have to return some bootstrap JavaScript which reads the identity token from localStorage and then passes it to the server in the next request, and only then the server can respond based on your identity. By any reasonable definition, the second approach is more complex, not to mention slower and more fragile.

So you mean, why use a simple solution when a newer, more complex solution is available?

by goto11 7y ago

So you mean, why use a simple solution when a newer, more complex solution is available?

Aside from their APIs they are both of equal complexity. Cookies have a far more complex API. https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie https://developer.mozilla.org/en-US/docs/Web/API/Document/co... https://en.m.wikipedia.org/wiki/Complexity https://en.m.wikipedia.org/wiki/Complexity Perhaps you instead meant to use the word challenging, which is subjective depending upon who you ask.

goto11 7y ago
But you don't even need to use the API to use cookies. You set them on the server, and the browser send them back. It works entirely without any JavaScript.
- austincheney 7y ago
  I already addressed that in the link in my original comment. https://news.ycombinator.com/item?id=23098196 https://news.ycombinator.com/item?id=23098196
ComputerGuru 7y ago
I’m guessing you’re a frontend guy. The two are only comparable from the frontend, if you’re developing a traditional app and want to use LS instead of cookies, it is certainly embarrassingly more complex as you’re forced into a JS intermediary to channel info between LS and your backend. So, no, certainly not equal complexity.
- austincheney 7y ago
  I am a fullstack developer. It is the same level of complexity because there is an intermediary either way. Web servers do provide authentication capabilities, but commercial web servers have not relied upon that since the late 90s / early 00s. Most web servers use something equivalent to Spring MVC to maintain both authentication and session management largely because the authentication capability supplied by the web server are only there to protect access to the server and thus directly doesn't account for most common security considerations, example OWASP Top 10. Authentication and session management across a network can be accomplished across a variety of ways. Operating systems prefer Kerberos for remote authentication. Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. The same end result, authentication and session management, can be accomplished with the same complexity without cookies. Complexity refers to the number of steps involved and not the challenge imposed upon the developer. https://en.wikipedia.org/wiki/Complexity https://en.wikipedia.org/wiki/Complexity The only reason to prefer an out-dated functionally obsolete technology is fear of disruption. I have explained all this already, please see the comment I linked to from above: https://news.ycombinator.com/item?id=23098196 https://news.ycombinator.com/item?id=23098196
  - goto11 7y ago
    > Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. You seem to believe that developers should always chose the most complex and intricate solution possible, and the only reason someone would chose a simpler solution would be due to incompetence or ignorance of the more complex solution. This is completely opposite of all good engineering practice. Complexity is not a goal, it is a liability. You want to have the minimum amount of complexity which solves the problem.
    - austincheney 7y ago
      I have defined complexity for you several times. Complexity is not hard just as simplicity is not easy. Just because some framework running on the server hides the challenges from you does not mean the complexity is lower. The complexity is dictated by the business requirements (the problem state).
      - ComputerGuru 7y ago
        You’re not getting it. You don’t need any intermediary framework or library to store state in cookies from the backend. You can do it without executing anything on the client. With LS, you are forced architecturally to execute code on the backend and in the browser just to accomplish the same thing. They’re incomparable.
      - goto11 7y ago
        Consider when you are visiting a page where you have been before, and you have received some identifier token. Using cookies, the browser automatically sends the identifier token along with the initial request, and the server can serve the initial response based on your identity. With localStorage, the browser initially send an anonymous request to the server, the server then have to return some bootstrap JavaScript which reads the identity token from localStorage and then passes it to the server in the next request, and only then the server can respond based on your identity. By any reasonable definition, the second approach is more complex, not to mention slower and more fragile.