3 ms·

Putting opinions on cookies aside for a moment, session cookies, cookies that store the language chosen by the user, etc. are examples of what is usually consid

Putting opinions on cookies aside for a moment, session cookies, cookies that store the language chosen by the user, etc. are examples of what is usually considered "required cookies". Now, the technical choices that lead to those things may not have been the wisest but the general thinking is that: - the site is less functional without those cookies so requiring them ensures a common baseline for all users, - they are used internally for things that are directly related to what the user is here for, so they are in a somewhat different league than all the cross-site targeting cookies everyone is concerned about, so they are less harmful. But the truth is that saving to and reading from cookies is not an absolute requirement of building websites.

onion2k 6y ago
cookies that store the language chosen by the user Preferences like that should be part of the URL schema. Picking language as a good example, a site can use a path variable (eg the part of the page URL after the domain) to store that information. https://example.com/en/page.html https://example.com/en/page.html, https://example.com/de/page.html https://example.com/de/page.html, https://example.com/es/page.html https://example.com/es/page.html, etc. Alternatively a site could use a subdomain for the same thing. There are many advantages to that approach, such as making it easier to route traffic to a local data center or leverage better edge caching for localized assets. It also means users can deep link straight to a page in their chosen language.
- johncoltrane 6y ago
  I totally agree with you but OP asked about how things are, not about how things should be. https://example.com/{en,fr}/page.html https://example.com/{en,fr}/page.html is indeed much better—and widely recommended, for that matter—but lots and lots of sites don't do that for one reason or another. If those sites use a cookie to store language choice, then it is IMO quite reasonable for the site operator to consider such a cookie as "required".
zzo38computer 6y ago
For language, use the Accept-Language header. For login, use basic/digest auth, or SASL (although, as far as I know, HTTP(S) doesn't have SASL, unfortunately). For dark mode, printing, mono/colours, use CSS media queries. For table of contents, ensure the <H1>, <H2>, etc is valid. For timezones and time formats, use the <TIME> command. For data tables, use the <TABLE> command; you can also include links to data in CSV, JSON, etc. For footnotes, use the <FN> command. For some things, you can use CSS classes which are not necessarily referred to in the CSS code that you have; the user can apply their own if they want special styles for some things that you don't have styles for. In other words, many things will not need cookies/scripts. If you do use the, ensure that they are fully documented, and that the documentation can be viewed without cookies/scripts/CSS enabled. This allows the user to know exactly what is being done, as well as the possibility to enable only the cookies they want, or to manually configure read-only cookies for preferences.
- mattmanser 6y ago
  It was a while ago now but I'm pretty certain that I read some comments here saying using Accept-Language is often a bad idea. From what I remember, your IT department may muck it up, or you're using a shared computer at say a hostel and someone's set it and you don't know how to change it, etc. Aside from that, most of your examples need a lot of foresight, work and knowledge to actually pull off.
  - zzo38computer 6y ago
    That is a valid consideration; it can use the URL to override the Accept-Language header (and the document can also include links for other languages, if appropriate). Likewise, the URL can also be used to override the Accept header.
- toast0 6y ago
  Accept-language is an okish default, but web pages end up needing to provide overrides because users are not always in control of those values, or the user may have preferences that don't fit the scheme. A cookie is a reasonable place to store the override. Http login is really hard to make user friendly, and has no way to logout in a user friendly way; the user needs to be prompted for a password again and not enter it. An HTML form and cookies just works better.

onion2k 6y ago

cookies that store the language chosen by the user Preferences like that should be part of the URL schema. Picking language as a good example, a site can use a path variable (eg the part of the page URL after the domain) to store that information. https://example.com/en/page.html https://example.com/en/page.html, https://example.com/de/page.html https://example.com/de/page.html, https://example.com/es/page.html https://example.com/es/page.html, etc. Alternatively a site could use a subdomain for the same thing. There are many advantages to that approach, such as making it easier to route traffic to a local data center or leverage better edge caching for localized assets. It also means users can deep link straight to a page in their chosen language.

johncoltrane 6y ago
I totally agree with you but OP asked about how things are, not about how things should be. https://example.com/{en,fr}/page.html https://example.com/{en,fr}/page.html is indeed much better—and widely recommended, for that matter—but lots and lots of sites don't do that for one reason or another. If those sites use a cookie to store language choice, then it is IMO quite reasonable for the site operator to consider such a cookie as "required".

zzo38computer 6y ago

For language, use the Accept-Language header. For login, use basic/digest auth, or SASL (although, as far as I know, HTTP(S) doesn't have SASL, unfortunately). For dark mode, printing, mono/colours, use CSS media queries. For table of contents, ensure the <H1>, <H2>, etc is valid. For timezones and time formats, use the <TIME> command. For data tables, use the <TABLE> command; you can also include links to data in CSV, JSON, etc. For footnotes, use the <FN> command. For some things, you can use CSS classes which are not necessarily referred to in the CSS code that you have; the user can apply their own if they want special styles for some things that you don't have styles for. In other words, many things will not need cookies/scripts. If you do use the, ensure that they are fully documented, and that the documentation can be viewed without cookies/scripts/CSS enabled. This allows the user to know exactly what is being done, as well as the possibility to enable only the cookies they want, or to manually configure read-only cookies for preferences.

mattmanser 6y ago
It was a while ago now but I'm pretty certain that I read some comments here saying using Accept-Language is often a bad idea. From what I remember, your IT department may muck it up, or you're using a shared computer at say a hostel and someone's set it and you don't know how to change it, etc. Aside from that, most of your examples need a lot of foresight, work and knowledge to actually pull off.
- zzo38computer 6y ago
  That is a valid consideration; it can use the URL to override the Accept-Language header (and the document can also include links for other languages, if appropriate). Likewise, the URL can also be used to override the Accept header.
toast0 6y ago
Accept-language is an okish default, but web pages end up needing to provide overrides because users are not always in control of those values, or the user may have preferences that don't fit the scheme. A cookie is a reasonable place to store the override. Http login is really hard to make user friendly, and has no way to logout in a user friendly way; the user needs to be prompted for a password again and not enter it. An HTML form and cookies just works better.