3 ms·
The first sentence > HTTP cookies were never intended for session management Seems odd. IIRC that's exactly what they were meant for. State management for htt
by prasadjoglekar 1y ago
The first sentence
> HTTP cookies were never intended for session management
Seems odd. IIRC that's exactly what they were meant for. State management for http which is stateless. Am I missing some history here?
- pfortuny 1y ago> This document specifies a way to create a stateful session with Hypertext Transfer Protocol (HTTP) requests and responses. It describes three new headers, Cookie, Cookie2, and Set-Cookie2, which carry state information between participating origin servers and user agents. The method described here differs from Netscape's Cookie proposal [Netscape], but it can interoperate with HTTP/1.0 user agents that use Netscape's method. (See the HISTORICAL section.) RFC 2965, make of it what you want but I agree with you. Actually, RFC 2109 is even older (1997) and says more or less the same.
- stephendause 1y agoI could be wrong, but I believe the author is referring to cookies being used for session authentication as opposed to general session management.
- TheRealPomax 1y agoThat's still exactly what they they were invented, though. The very first example in RFC2109 is literally for tying a session to a login. The "abstract idea" of a cookie is an identifier that it lets a server consider requests within a larger series of requests by the same person, but the fact that it can do that at all also meant that it solved the whole "how do we know whether this user is logged in without every page request after login needing to be a POST that includes the user's name and password again".
- echelon 1y agoI'm starting to look at every technology change Google makes as a way for them to entrench their moat. The faster we get an antitrust breakup of Google from Chrome and Android, the better.