4 ms·
> One of the absolute worst design decisions I made was to design the application so that it would support sessions for users without cookies enabled. I think
by unfocussed_mike 5y ago
> One of the absolute worst design decisions I made was to design the application so that it would support sessions for users without cookies enabled.
I think we all did this at least once back then and all regret it for the same reasons...
- hackernewds 5y agowhy don't we do it anymore
- samwillis 5y agoIf you include the session ID in the url it can leak to other uses if they send a urls to someone, it also exposes the session id in intermediate proxy/router log files (if using plain http, not tls). So it’s basically a security risk. Before cookies had widespread support it was basically the only way to implement sessions.