5 ms·
Technically, a `session_id` in query parameters is just like a cookie (can be used to track you), except that it doesn't persist. I'd consider it a basic featu
by tomp 4y ago
Technically, a `session_id` in query parameters is just like a cookie (can be used to track you), except that it doesn't persist.
I'd consider it a basic feature that if I reload a website, or open it in a new tab, I'm still logged in, the shopping cart is still full, and I see past messages in the chat window.
While technically all of the above can be implemented without cookies (in a very user-unfriendly way), it's so below the expected user experience that I'd argue that cookies are strictly necessary for these purposes.
- jakear 4y agoIndexedDB/LocalStorage can do all that without relying on the server. The real shame is that Apple has decided IndexedDB is too powerful to allow outside of their walled garden and will auto-delete it after a week or so. Worse still, Service Worker caches are cleared so offline-available websites break after a week. https://stackoverflow.com/questions/50795409/is-indexeddb-on-safari-guaranteed-to-be-persistent#:~:text=According%20to%20this%20blog%20post%20from%20the%20WebKit,of%20Safari%20usage%20without%20interaction%20with%20the%20site%3A https://stackoverflow.com/questions/50795409/is-indexeddb-on...
- jefftk 4y agoThe EU cookie law (ePrivacy Directive) isn't specific to cookies. Using local storage does not exempt you from its requirements, and you still need to get consent from users before any use of client side storage that is not strictly necessary to provide a service explicitly requested by the user.
- jakear 4y agoAdding an item to a cart and it persisting is quite directly a service explicitly requested by the user. And if some EU kangaroo court forces me to click through a “clicking add to cart will save this item in your cart, do you agree to performing the action you explicitly just requested” on every website… I cannot.
- jefftk 4y agoIf you put it in their cart and it is still there after the user has closed their browser and reopened it a few days later, you're in violation. See section 2.3: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
- Scarblac 4y agoNone of that needs to happen on the server, so cookies aren't needed.
- pyrale 4y ago> I'd consider it a basic feature that if I reload a website, or open it in a new tab, I'm still logged in, the shopping cart is still full, and I see past messages in the chat window. That is, as if, to the site owner, you were not anonymous. It's ok for you to want that, the law is there to protect the ones that don't want it. Because, as it is, websites tend to side with you already.
- tomp 4y agoThe idea of logging in is that you're no longer anonymous. You can, of course, always use a private browser window if you want to limit everything to just that one tab.
- anankaie 4y agoPrivate Chromium-based browser windows share state between tabs, at least on Windows*. You need to close out all private instances of that "install" of the browser to drop the contents: They are just not saved into a history, beyond that tab's history. Cookies, however, are stored (in memory, I am guessing) until the session closes. ------ * - others might too, but I only have access to Chromium/Win right now.