3 ms·

To put it another way for those who don't web-dev much. Getting rid of cookies completely _requires_ that any authenticated experience becomes an SPA (e. g. on

To put it another way for those who don't web-dev much. Getting rid of cookies completely _requires_ that any authenticated experience becomes an SPA (e. g. only works with JavaScript enabled). The sole alternative available today is to include the session identifier in the URL, which means the end user cannot share links safely and that anything that logs the URL logs the session key. Everything that browser makers are suggesting as a replacement for cookies also requires JS to function.

_heimdall 2y ago
The hot take here, and one I'd be really interested to see proven wrong, is that we can't have cookies and privacy online. User authorization is a very specific use case. Cookies are a generic solution, if we only care about that one use case there is likely a solution that wouldn't open the door for the privacy-destroying tracking that we don't want. As far as SPAs go, without cookies SPAs could still have issues. User author tokens can be stored in local storage and included with all API requests, but that has its own security issues.
- squigz 2y ago
  What is it about modern cookie implementations that make them more easily abused than whatever solution might be able to replace the current widespread usage of cookies for i.e., authorization and user settings?
  - _heimdall 2y ago
    User settings that live client-side only wouldn't be a problem. The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. Authorization is an interesting challenge without cookies, but I do expect it could be solved in a way that is specific to supporting authorization without adding back a general key/value store.
    - squigz 2y ago
      > The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. That's not a challenge. That's a benefit. Anyway you didn't actually answer my question, so allow me: the answer is nothing. There is nothing about cookies that enable them to be abused more than any system that could take their place. Which is to say, the issue here isn't the technology, so a technical solution likely won't work without neutering the entire point of cookies. The idea of 'removing cookies entirely' over just making it illegal to collect and share private information is... a bit crazy.
deleted 2y ago
[deleted]
raxxorraxor 2y ago
We could also go back to basic auth. No idea how long browsers keep your login to be resend every time, but they do so as it seems. So you don't have to type in you login on every refresh at least. But yeah, any known convenience would die without any and all cookies.

_heimdall 2y ago

The hot take here, and one I'd be really interested to see proven wrong, is that we can't have cookies and privacy online. User authorization is a very specific use case. Cookies are a generic solution, if we only care about that one use case there is likely a solution that wouldn't open the door for the privacy-destroying tracking that we don't want. As far as SPAs go, without cookies SPAs could still have issues. User author tokens can be stored in local storage and included with all API requests, but that has its own security issues.

squigz 2y ago
What is it about modern cookie implementations that make them more easily abused than whatever solution might be able to replace the current widespread usage of cookies for i.e., authorization and user settings?
- _heimdall 2y ago
  User settings that live client-side only wouldn't be a problem. The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. Authorization is an interesting challenge without cookies, but I do expect it could be solved in a way that is specific to supporting authorization without adding back a general key/value store.
  - squigz 2y ago
    > The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. That's not a challenge. That's a benefit. Anyway you didn't actually answer my question, so allow me: the answer is nothing. There is nothing about cookies that enable them to be abused more than any system that could take their place. Which is to say, the issue here isn't the technology, so a technical solution likely won't work without neutering the entire point of cookies. The idea of 'removing cookies entirely' over just making it illegal to collect and share private information is... a bit crazy.

deleted 2y ago

[deleted]

raxxorraxor 2y ago

We could also go back to basic auth. No idea how long browsers keep your login to be resend every time, but they do so as it seems. So you don't have to type in you login on every refresh at least. But yeah, any known convenience would die without any and all cookies.