4 ms·

The idea of shoving everything into an encrypted cookie --- it seems like it should work well, and I really like not storing session state server-side. Wouldn't

by gcv 17y ago

The idea of shoving everything into an encrypted cookie --- it seems like it should work well, and I really like not storing session state server-side. Wouldn't the cookie run afoul of some security problem or other, though? I'm having a hard time thinking up scenarios, but I am not a security expert. http://news.ycombinator.com/item?id=639647 http://news.ycombinator.com/item?id=639647 [EDIT] Also interesting that the talk did not mention nginx as either a proxy or a software load balancer.

zepolen 17y ago
No, as it's signed and also will have a timeout long before someone can brute it.
sunkencity 17y ago
rails comes with cookie sessions by default.
asb 17y ago
You might be interested in Steven Murdoch's paper 'Hardened stateless session cookies'. See this blog post for the paper and some other related links: http://www.lightbluetouchpaper.org/2008/05/16/hardened-stateless-session-cookies/ http://www.lightbluetouchpaper.org/2008/05/16/hardened-state...
zmimon 17y ago
One thing you gotta remember is that that cookie is going to get shoved up to your server with every single request (images, css, ajax, everything). So if you end up putting 2k of stuff in there then it can really add up (esp. given that many clients have asymmetric connection speed). You don't want your tiny ajax requests that load 50 bytes of data sending the equivalent of 4 - 8k upstream because they are all sending a bunch of unnecessary stuff in your cookie. So, yes, it's good - but the key to it is keeping the cookie "slim". (NB: couldn't see the presentation since I don't have flash, if they covered this, apologies).
- lsb 17y ago
  Yes, this is why you load images and CSS from a CDN, and you can do JSON+callbacks instead of Ajax onto a big app server somewhere. (There's a gem for Rack, if you're on Ruby, to automatically handle the parenthesization.)
  - gcv 17y ago
    What do you mean by JSON+callbacks?
    - lsb 17y ago
      You promote data to code. JSON is usually a data format, like {result: 42}. If you wrap that in callback({result: 42}), that's executable javascript code. Including script tags on your pags via JS, like how the Delicious API / Flickr API / Google Translate & whatnot APIs, all rely on this. Check out http://developer.yahoo.com/common/json.html#callbackparam http://developer.yahoo.com/common/json.html#callbackparam

by gcv 17y ago

zepolen 17y ago

No, as it's signed and also will have a timeout long before someone can brute it.

sunkencity 17y ago

rails comes with cookie sessions by default.

asb 17y ago

You might be interested in Steven Murdoch's paper 'Hardened stateless session cookies'. See this blog post for the paper and some other related links: http://www.lightbluetouchpaper.org/2008/05/16/hardened-stateless-session-cookies/ http://www.lightbluetouchpaper.org/2008/05/16/hardened-state...

zmimon 17y ago

One thing you gotta remember is that that cookie is going to get shoved up to your server with every single request (images, css, ajax, everything). So if you end up putting 2k of stuff in there then it can really add up (esp. given that many clients have asymmetric connection speed). You don't want your tiny ajax requests that load 50 bytes of data sending the equivalent of 4 - 8k upstream because they are all sending a bunch of unnecessary stuff in your cookie. So, yes, it's good - but the key to it is keeping the cookie "slim". (NB: couldn't see the presentation since I don't have flash, if they covered this, apologies).

lsb 17y ago
Yes, this is why you load images and CSS from a CDN, and you can do JSON+callbacks instead of Ajax onto a big app server somewhere. (There's a gem for Rack, if you're on Ruby, to automatically handle the parenthesization.)
- gcv 17y ago
  What do you mean by JSON+callbacks?
  - lsb 17y ago
    You promote data to code. JSON is usually a data format, like {result: 42}. If you wrap that in callback({result: 42}), that's executable javascript code. Including script tags on your pags via JS, like how the Delicious API / Flickr API / Google Translate & whatnot APIs, all rely on this. Check out http://developer.yahoo.com/common/json.html#callbackparam http://developer.yahoo.com/common/json.html#callbackparam