3 ms·

Why do so many sites require cookies just to tell me what they are all about? Yes, I am of the lunatic fringe that blocks all cookies by default... ...and by d

Why do so many sites require cookies just to tell me what they are all about? Yes, I am of the lunatic fringe that blocks all cookies by default... ...and by default more and more web sites lose me as a potential client/user/whatev because they require cookies just to display static welcoming information... ...I lose nothing by this, as far as I can tell. Perhaps ignorance really is bliss. :->

dguaraglia 12y ago
I guess most websites nowadays are built using one of the myriad web frameworks out there (Django, RoR, you name it.) Most of this frameworks enable sessions by default, simply because it's what most websites will want if they manage any kind of state. Nothing nefarious about it.
- jarrett 12y ago
  > Most of this frameworks enable sessions by default True, but in my experience, the major frameworks don't automatically lock out users with cookies disabled. For example, on a Rails app with no before_filter on the homepage, you can start the server and do this: echo "GET / HTTP/1.1" | nc localhost 3000 You should get back the homepage HTML.
diafygi 12y ago
One legit reason is to set a CSRF cookie. If there's a login or signup form on the page, many frameworks add a CSRF field to the form that should match the cookie. When you POST the form, the cookie and the field must match.
- PeterWhittaker 12y ago
  Sure, that's legit - if login or signup is required. But for pages containing information intended to encourage a user to spend time on a site, to get convinced they need to sign-up, it's counter-productive.
flippyhead 12y ago
This is a great point and not one I'd ever even considered. You are right, the page you see first -- before signing up -- really doesn't need much. I am, in fact, using the Meteor stack for the entire thing, even the informational pages. But that was mostly a convenience.
- PeterWhittaker 12y ago
  Thanks for answering and for accepting this comment - I needed the validation, since I lost two karma points on the comment. Ironic, no? :->

dguaraglia 12y ago

I guess most websites nowadays are built using one of the myriad web frameworks out there (Django, RoR, you name it.) Most of this frameworks enable sessions by default, simply because it's what most websites will want if they manage any kind of state. Nothing nefarious about it.

jarrett 12y ago
> Most of this frameworks enable sessions by default True, but in my experience, the major frameworks don't automatically lock out users with cookies disabled. For example, on a Rails app with no before_filter on the homepage, you can start the server and do this: echo "GET / HTTP/1.1" | nc localhost 3000 You should get back the homepage HTML.

diafygi 12y ago

One legit reason is to set a CSRF cookie. If there's a login or signup form on the page, many frameworks add a CSRF field to the form that should match the cookie. When you POST the form, the cookie and the field must match.

PeterWhittaker 12y ago
Sure, that's legit - if login or signup is required. But for pages containing information intended to encourage a user to spend time on a site, to get convinced they need to sign-up, it's counter-productive.

flippyhead 12y ago

This is a great point and not one I'd ever even considered. You are right, the page you see first -- before signing up -- really doesn't need much. I am, in fact, using the Meteor stack for the entire thing, even the informational pages. But that was mostly a convenience.

PeterWhittaker 12y ago
Thanks for answering and for accepting this comment - I needed the validation, since I lost two karma points on the comment. Ironic, no? :->