3 ms·
Except they can never allow you to do anything dynamic on the server or you'd be able to read the HttpOnly github session cookies of anyone logged into github.c
by Harkins 18y ago
Except they can never allow you to do anything dynamic on the server or you'd be able to read the HttpOnly github session cookies of anyone logged into github.com itself.
Well, they could, but they'd have to move to www.github.com exclusively, wait for all those session cookies to expire or for folks to visit and get them reset...
- snitko 18y agoYou can read cookies from javascript, so it's not the issue. I think cookies' domain names are set strictly to 'github.com', not '*.github.com'.
- KirinDave 18y agoActually, this isn't so true anymore. A friend of mine is a web developer and he's got a shocking dynamic site that the server treats as entirely static. He accomplishes this with JSON callbacks. http://iancollins.me http://iancollins.me (P.S. For a good time, click on the white background box or the "3N" logo when you're using are recent webkit nightly. Ian has a... ironic sense of humor.)
- mojombo 18y agoGitHub cookies are restricted to github.com and gist.github.com domains (using a redirect trick to allow cross subdomain cookie sharing). You can use all the JavaScript you like on your Pages.
- Harkins 18y agoThere's not redirect trick, the cookies are just set to .github.com. I didn't say anything about JavaScript being disallowed, the cookies are HttpOnly. So I said that you can't do things on the server.
- defunkt 18y agoThe .github.com cookie is old and useless. You can't use it to do anything - it's a relic of our old authentication system. We should have made sure they were deleted before switching to the new cookie as it's caused some confusion. What mojombo said is accurate. (He's a GitHub co-founder and I'm the person who wrote the redirect code.)