4 ms·
But nowadays there are lightening-fast distributed key-value stores that are ideal for storing session data. "Lightning fast" is still a lot slower than no loo
by moe 14y ago
But nowadays there are lightening-fast distributed key-value stores that are ideal for storing session data.
"Lightning fast" is still a lot slower than no lookup at all.
A few bytes of cookie cost next to nothing in terms of bandwidth nor latency and can save a lot of hardware on the backend for large sites.
- mark_story 14y agoSure it costs nothing until you are compromised and any valuable data you have is taken. Remote code exploits are extremely dangerous. And mitigating them with a small amount of i/o overhead seems like a fair trade off.
- moe 14y agoThat's unrelated. You can store data in cookies without using a potentially unsafe serialization scheme. Baby != Bathwater.
- jacques_chester 14y agoSecurity is more important. Storing anything in the cookie apart from a simple identifying token increases the attack surface. If you use encryption and an HMAC to harden up said cookie, you need to a) not bugger up your scheme and b) pay the overhead the calculations. For the HMAC it's trivial, but ciphers are a bit more involved.
- moe 14y agoI agree there's a small risk of buggering up. But it's a one-time effort to get it right and reviewed, encrypting a string is not exactly rocket science. AES overhead is a non-issue for all but the very largest sites. A modern CPU can pipe north of 100MB/sec through AES - it's very unlikely to become the bottleneck in a python web-app.