3 ms·

We could put a stop to marketing redirects tomorrow if we didn't allow redirects to set cookies. (Or perhaps only allowed a cookie if the redirect was served b

We could put a stop to marketing redirects tomorrow if we didn't allow redirects to set cookies. (Or perhaps only allowed a cookie if the redirect was served by the same domain as the target domain.)

jacquesm 12y ago
That will break just about every affiliate program that I'm aware of. Of course this is your intention but there will be a very large number of websites that will see their turnover plummet if that should happen. I personally would not mind but I'm pretty sure that a lot of monied interests would not like to see this happen.
noblethrasher 12y ago
That could break a lot of bad-yet-benign code.
- MichaelGG 12y ago
  Yeah like half the login systems in the world?
thrill 12y ago
Seems logical - only allow the endpoint to set the cookie.
narsil 12y ago
This would result in marketers returning 200 responses to set the cookie and render a page with javascript that sets `window.location` instead, which would be even slower.
- Eridrus 12y ago
  I think this is worth hammering home. People want analytics information, and the only way we can do this now is by adding things like this. (Not strictly true, but ease of deployment, etc). Unless you shut down the only way to do something, the people who want this service will work around whatever restrictions have been put in place, and the solution we get will probably be even uglier. The real way to get rid of this is to provide a mechanism that addresses everyone's desires.
  - chii 12y ago
    the problem is that these analytics are only beneficial to the owners or advertisers, which means if there's a way for users to turn off the supposed capability, then the advertisers would find a different way to do it, which results in much the same thing as today. it's a social problem, not a technological one imho.
euank 12y ago
This still doesn't stop all use-cases. Click count statistics, time-clicked, and geo-information can all be gotten without any cookies. Some sites use url shorteners just to see clickthrough statistics, which can always be determined with no cookies etc.
porpoisemonkey 12y ago
How would that affect the single sign-on case? AFAIK it's common practice to issue redirects to people who are not authenticated to send them to the identity provider's (IDP's) login page. This would make it hard for an IDP to determine if the user already has an active session with them.

We could put a stop to marketing redirects tomorrow if we didn't allow redirects to set cookies. (Or perhaps only allowed a cookie if the redirect was served by the same domain as the target domain.)

jacquesm 12y ago

That will break just about every affiliate program that I'm aware of. Of course this is your intention but there will be a very large number of websites that will see their turnover plummet if that should happen. I personally would not mind but I'm pretty sure that a lot of monied interests would not like to see this happen.

noblethrasher 12y ago

That could break a lot of bad-yet-benign code.

MichaelGG 12y ago
Yeah like half the login systems in the world?

thrill 12y ago

Seems logical - only allow the endpoint to set the cookie.

narsil 12y ago

This would result in marketers returning 200 responses to set the cookie and render a page with javascript that sets `window.location` instead, which would be even slower.

Eridrus 12y ago
I think this is worth hammering home. People want analytics information, and the only way we can do this now is by adding things like this. (Not strictly true, but ease of deployment, etc). Unless you shut down the only way to do something, the people who want this service will work around whatever restrictions have been put in place, and the solution we get will probably be even uglier. The real way to get rid of this is to provide a mechanism that addresses everyone's desires.
- chii 12y ago
  the problem is that these analytics are only beneficial to the owners or advertisers, which means if there's a way for users to turn off the supposed capability, then the advertisers would find a different way to do it, which results in much the same thing as today. it's a social problem, not a technological one imho.

euank 12y ago

This still doesn't stop all use-cases. Click count statistics, time-clicked, and geo-information can all be gotten without any cookies. Some sites use url shorteners just to see clickthrough statistics, which can always be determined with no cookies etc.

porpoisemonkey 12y ago

How would that affect the single sign-on case? AFAIK it's common practice to issue redirects to people who are not authenticated to send them to the identity provider's (IDP's) login page. This would make it hard for an IDP to determine if the user already has an active session with them.