4 ms·

I completely reject the premise of this, that one is somehow EU citizens are not personally responsible for the information they themselves put online. The mos

I completely reject the premise of this, that one is somehow EU citizens are not personally responsible for the information they themselves put online. The most hilarious thing is cookies! For example, cookies exist, and they work a certain way... and despite not liking how they work.. they are here, and not going away, and imposing some kind of contract-law of cookies being accepted or rejected totally ignores that the user has, and always had, the ability to reject cookies at the browser level, unilaterally or with policies, without any contract laws.

avmich 4y ago
The idea of cookies was to establish sessions - something which can be done by other means, so cookies aren't needed. It would be good to have browsers which would clean all cookies every browser restart. Not enough though, some browser sessions can last months, so a better solution is needed.
- red_trumpet 4y ago
  > something which can be done by other means, so cookies aren't needed How does one actually do that? Embed a session id in every request/response?
  - avmich 4y ago
    Yes, each request can explicitly (well, not for the end user) carry the session id - or, say, one of the previous request ids. Cookies do that automatically, but have side effects by remaining in the system.
    - lukeramsden 4y ago
      Is there any way of maintaining session IDs across requests without JavaScript other than cookies? My understanding is, the whole point of cookies is that they're automatically sent by the user agent, anything else that was stored (such as in LocalStorage) could only be used by JS scripts.
      - avmich 4y ago
        If your whole website doesn't use JavaScript and every request reloads the page, that reloaded page can contain current session id, right? Why do we need to rely on automation which does this thing, with known drawbacks, but can't do that ourselves?
        lukeramsden 4y ago
        > that reloaded page can contain current session id, right Right, through cookies - unless you want to embed the session ID in every single link or button in the whole page. The way pages "contain" session data like that _is_ cookies! snapetom mentions embedding in query parameters, which while a possible solution, seems even worse to me, as it means sharing a link to the current page you're on leaks your session token. I'm really not sure I'm following what you're saying here.
      - snapetom 4y ago
        Embed them in query parameters. EDIT: What I originally wrote is somewhat off. It was directly in PHP: https://www.php.net/manual/en/session.idpassing.php https://www.php.net/manual/en/session.idpassing.php I don't know if I'm remembering right, but I seem to remember some early PHP framework or templating system, $_SESSION variables could be configured to use query parameters instead of cookies. So every link generated by the framework automatically inserted a "?SESSIONID=12345" at the end of the link. The backend translated this into the PHP $_SESSION object.
- kall 4y ago
  I don't know of another way that reaches the same security model as secure httpOnly cookies, which are the recommended way to do session cookies.

avmich 4y ago

The idea of cookies was to establish sessions - something which can be done by other means, so cookies aren't needed. It would be good to have browsers which would clean all cookies every browser restart. Not enough though, some browser sessions can last months, so a better solution is needed.

red_trumpet 4y ago
> something which can be done by other means, so cookies aren't needed How does one actually do that? Embed a session id in every request/response?
- avmich 4y ago
  Yes, each request can explicitly (well, not for the end user) carry the session id - or, say, one of the previous request ids. Cookies do that automatically, but have side effects by remaining in the system.
  - lukeramsden 4y ago
    Is there any way of maintaining session IDs across requests without JavaScript other than cookies? My understanding is, the whole point of cookies is that they're automatically sent by the user agent, anything else that was stored (such as in LocalStorage) could only be used by JS scripts.
    - avmich 4y ago
      If your whole website doesn't use JavaScript and every request reloads the page, that reloaded page can contain current session id, right? Why do we need to rely on automation which does this thing, with known drawbacks, but can't do that ourselves?
      - lukeramsden 4y ago
        > that reloaded page can contain current session id, right Right, through cookies - unless you want to embed the session ID in every single link or button in the whole page. The way pages "contain" session data like that _is_ cookies! snapetom mentions embedding in query parameters, which while a possible solution, seems even worse to me, as it means sharing a link to the current page you're on leaks your session token. I'm really not sure I'm following what you're saying here.
    - snapetom 4y ago
      Embed them in query parameters. EDIT: What I originally wrote is somewhat off. It was directly in PHP: https://www.php.net/manual/en/session.idpassing.php https://www.php.net/manual/en/session.idpassing.php I don't know if I'm remembering right, but I seem to remember some early PHP framework or templating system, $_SESSION variables could be configured to use query parameters instead of cookies. So every link generated by the framework automatically inserted a "?SESSIONID=12345" at the end of the link. The backend translated this into the PHP $_SESSION object.
kall 4y ago
I don't know of another way that reaches the same security model as secure httpOnly cookies, which are the recommended way to do session cookies.