4 ms·

I'm surprised that hash parameters are not mentioned to store state. They have many advantages that (for the kind of apps I do) work pretty well: * they are no

I'm surprised that hash parameters are not mentioned to store state. They have many advantages that (for the kind of apps I do) work pretty well: * they are not sent to the server * hence, the URL size limit is that of the browser, not that of the backend handling the request * hence, they disclose less info to the middlemen * they can be shared easily from person to person One drawback is that they require more processing on the frontend side. As always, trade offs.

mro_name 4y ago
especially neat when a crypto key like at https://sebsauvage.net/wiki/doku.php?id=php:zerobin https://sebsauvage.net/wiki/doku.php?id=php:zerobin
ignoramous 4y ago
> they are not sent to the server The fact that the url hash-fragment isn't sent to the web server is a mere default. There's no controlling what plugins or scripts do. > hence, they disclose less info to the middlemen Care to elaborate? I don't see how a url (over tls) exposes more information unless tls is MiTM'd. > they can be shared easily from person to person That's a property of the url itself, and not unique to the hash-fragment, per se?
- xcambar 4y ago
  Fair point. > I don't see how a url (over tls) exposes more information unless tls is MiTM'd. What is not sent cannot be hacked. I was not suggesting an explicit security feature, rather a state of things. > That's a property of the url itself, and not unique to the hash-fragment, per se? Yes, but it makes for a nice combo with the previous point, as the URL now contains 2 things: the Locator itself that your peer and the server will access and (resp.) serve, plus the context that only your peer will have access to.
  - dgb23 4y ago
    Thank you for bringing this up. This is a very good point. I have thought of hash URLs being obsolete outside of some neat CSS tricks and section anchoring. But they still serve a purpose outside of that and can even simplify server side handling in some cases.
the_gipsy 4y ago
> they are not sent to the server This is, usually, a huge disadvantage. E.g. the filter parameters in the article.
- xcambar 4y ago
  As the article points out, spread your params where they belong _in your specific context_.
cryptonector 4y ago
The correct term for these is "fragment identifiers". They're not parameters. They are meant to identify, e.g., anchors in documents identified by the rest of the URI. And, yes, you can use those too, especially for SPAs!

mro_name 4y ago

especially neat when a crypto key like at https://sebsauvage.net/wiki/doku.php?id=php:zerobin https://sebsauvage.net/wiki/doku.php?id=php:zerobin

ignoramous 4y ago

> they are not sent to the server The fact that the url hash-fragment isn't sent to the web server is a mere default. There's no controlling what plugins or scripts do. > hence, they disclose less info to the middlemen Care to elaborate? I don't see how a url (over tls) exposes more information unless tls is MiTM'd. > they can be shared easily from person to person That's a property of the url itself, and not unique to the hash-fragment, per se?

xcambar 4y ago
Fair point. > I don't see how a url (over tls) exposes more information unless tls is MiTM'd. What is not sent cannot be hacked. I was not suggesting an explicit security feature, rather a state of things. > That's a property of the url itself, and not unique to the hash-fragment, per se? Yes, but it makes for a nice combo with the previous point, as the URL now contains 2 things: the Locator itself that your peer and the server will access and (resp.) serve, plus the context that only your peer will have access to.
- dgb23 4y ago
  Thank you for bringing this up. This is a very good point. I have thought of hash URLs being obsolete outside of some neat CSS tricks and section anchoring. But they still serve a purpose outside of that and can even simplify server side handling in some cases.

the_gipsy 4y ago

> they are not sent to the server This is, usually, a huge disadvantage. E.g. the filter parameters in the article.

xcambar 4y ago
As the article points out, spread your params where they belong _in your specific context_.

cryptonector 4y ago

The correct term for these is "fragment identifiers". They're not parameters. They are meant to identify, e.g., anchors in documents identified by the rest of the URI. And, yes, you can use those too, especially for SPAs!