3 ms·
I would think you could get away with using (ip, user-agent) to, fairly reliably, recreate a cookie. It seems like it would be pretty rare for a user to clear t
by ZitchDog 12y ago
I would think you could get away with using (ip, user-agent) to, fairly reliably, recreate a cookie. It seems like it would be pretty rare for a user to clear their cookies _and_ get a new IP address at the same time.
- brokentone 12y agoThe correlations can be pretty taxing though, these processes are cheap and client-side.
- kazinator 12y agoBingo: the beauty of the cookie is that the client stores it for you. If you start storing IP address and user agent info, you open yourself to attacks that try to flood your database. If a botnet visits your website with millions of different IP addresses, and each one fakes half a dozen user agents, oops! (The lesson from TCP and why it has SYN cookies now.)