4 ms·

I am a fullstack developer. It is the same level of complexity because there is an intermediary either way. Web servers do provide authentication capabilities

I am a fullstack developer. It is the same level of complexity because there is an intermediary either way. Web servers do provide authentication capabilities, but commercial web servers have not relied upon that since the late 90s / early 00s. Most web servers use something equivalent to Spring MVC to maintain both authentication and session management largely because the authentication capability supplied by the web server are only there to protect access to the server and thus directly doesn't account for most common security considerations, example OWASP Top 10. Authentication and session management across a network can be accomplished across a variety of ways. Operating systems prefer Kerberos for remote authentication. Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. The same end result, authentication and session management, can be accomplished with the same complexity without cookies. Complexity refers to the number of steps involved and not the challenge imposed upon the developer. https://en.wikipedia.org/wiki/Complexity https://en.wikipedia.org/wiki/Complexity The only reason to prefer an out-dated functionally obsolete technology is fear of disruption. I have explained all this already, please see the comment I linked to from above: https://news.ycombinator.com/item?id=23098196 https://news.ycombinator.com/item?id=23098196

goto11 7y ago
> Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. You seem to believe that developers should always chose the most complex and intricate solution possible, and the only reason someone would chose a simpler solution would be due to incompetence or ignorance of the more complex solution. This is completely opposite of all good engineering practice. Complexity is not a goal, it is a liability. You want to have the minimum amount of complexity which solves the problem.
- austincheney 7y ago
  I have defined complexity for you several times. Complexity is not hard just as simplicity is not easy. Just because some framework running on the server hides the challenges from you does not mean the complexity is lower. The complexity is dictated by the business requirements (the problem state).
  - ComputerGuru 7y ago
    You’re not getting it. You don’t need any intermediary framework or library to store state in cookies from the backend. You can do it without executing anything on the client. With LS, you are forced architecturally to execute code on the backend and in the browser just to accomplish the same thing. They’re incomparable.
  - goto11 7y ago
    Consider when you are visiting a page where you have been before, and you have received some identifier token. Using cookies, the browser automatically sends the identifier token along with the initial request, and the server can serve the initial response based on your identity. With localStorage, the browser initially send an anonymous request to the server, the server then have to return some bootstrap JavaScript which reads the identity token from localStorage and then passes it to the server in the next request, and only then the server can respond based on your identity. By any reasonable definition, the second approach is more complex, not to mention slower and more fragile.
ComputerGuru 7y ago
That’s not how it works. You can’t just gloss over needing to use JS as if it were merely a different language that compiled to the same bytecode. I’m not talking about complexity in terms of the number of frameworks or libraries you need to install. I’m talking about actual, measurable complexity in any objective metric you choose such as in terms of the number of distinct system, layers, hops, components, layers, etc you need to go through. There’s no comparing reading an http header included in the first lines of each and every request with the extremely brittle and objectively complex approach you are talking about. JavaScript is absolutely not intended to function as a core part of merely making authenticated web requests between the browser and the server. I’m saddened by how often I need to explain this.
- austincheney 7y ago
  That is not what I said. What I said was: The only reason to prefer an out-dated functionally obsolete technology is fear of disruption. If the reason for using an obsolete technology exists for selfishness more than the needs of the business, then yes, it is a form of incompetence even when that distinction is indistinguishable. JavaScript is a general purpose high level language that happens to natively run in the browser. My original point is that cookies are functionally obsolete and still in frequent use because developers are generally afraid of JavaScript. The more this conversation divests from authentication towards JavaScript the more credibility you lend my original opinion. It’s the same level of complexity either way because whether you use cookies or some other storage mechanism the business requirements around authentication remain the same the and the steps to accomplish those requirements are not so drastically different.
  - ComputerGuru 7y ago
    I’m sorry, but as I have proven the two are not equal in complexity (among other things) then any future inference based on that assumption is void, most especially your assertion that the only reason people aren’t using LocalStorage over Cookies is because they’re somehow “afraid” of JavaScript. It’s like saying “the reason people don’t use apple juice to make mimosas and continue to use obsolete oranges is because they’re irrationally afraid of apple peelers.” Do you see how many things are wrong in that statement?

goto11 7y ago

> Cookies are preferred by developers who fear JavaScript precisely because because they can be written and transmitted without need for JavaScript. You seem to believe that developers should always chose the most complex and intricate solution possible, and the only reason someone would chose a simpler solution would be due to incompetence or ignorance of the more complex solution. This is completely opposite of all good engineering practice. Complexity is not a goal, it is a liability. You want to have the minimum amount of complexity which solves the problem.

austincheney 7y ago
I have defined complexity for you several times. Complexity is not hard just as simplicity is not easy. Just because some framework running on the server hides the challenges from you does not mean the complexity is lower. The complexity is dictated by the business requirements (the problem state).
- ComputerGuru 7y ago
  You’re not getting it. You don’t need any intermediary framework or library to store state in cookies from the backend. You can do it without executing anything on the client. With LS, you are forced architecturally to execute code on the backend and in the browser just to accomplish the same thing. They’re incomparable.
- goto11 7y ago
  Consider when you are visiting a page where you have been before, and you have received some identifier token. Using cookies, the browser automatically sends the identifier token along with the initial request, and the server can serve the initial response based on your identity. With localStorage, the browser initially send an anonymous request to the server, the server then have to return some bootstrap JavaScript which reads the identity token from localStorage and then passes it to the server in the next request, and only then the server can respond based on your identity. By any reasonable definition, the second approach is more complex, not to mention slower and more fragile.

ComputerGuru 7y ago

That’s not how it works. You can’t just gloss over needing to use JS as if it were merely a different language that compiled to the same bytecode. I’m not talking about complexity in terms of the number of frameworks or libraries you need to install. I’m talking about actual, measurable complexity in any objective metric you choose such as in terms of the number of distinct system, layers, hops, components, layers, etc you need to go through. There’s no comparing reading an http header included in the first lines of each and every request with the extremely brittle and objectively complex approach you are talking about. JavaScript is absolutely not intended to function as a core part of merely making authenticated web requests between the browser and the server. I’m saddened by how often I need to explain this.

austincheney 7y ago
That is not what I said. What I said was: The only reason to prefer an out-dated functionally obsolete technology is fear of disruption. If the reason for using an obsolete technology exists for selfishness more than the needs of the business, then yes, it is a form of incompetence even when that distinction is indistinguishable. JavaScript is a general purpose high level language that happens to natively run in the browser. My original point is that cookies are functionally obsolete and still in frequent use because developers are generally afraid of JavaScript. The more this conversation divests from authentication towards JavaScript the more credibility you lend my original opinion. It’s the same level of complexity either way because whether you use cookies or some other storage mechanism the business requirements around authentication remain the same the and the steps to accomplish those requirements are not so drastically different.
- ComputerGuru 7y ago
  I’m sorry, but as I have proven the two are not equal in complexity (among other things) then any future inference based on that assumption is void, most especially your assertion that the only reason people aren’t using LocalStorage over Cookies is because they’re somehow “afraid” of JavaScript. It’s like saying “the reason people don’t use apple juice to make mimosas and continue to use obsolete oranges is because they’re irrationally afraid of apple peelers.” Do you see how many things are wrong in that statement?