3 ms·
How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.
by geographomics 12y ago
How is this better than using cookies? I don't really see the advantage of moving session identification down a layer.
- Sarien 12y agoIt's better because your browser doesn't have a button to clear your ssh private keys. Cookies simply aren't meant for storing important data.
- jimktrains2 12y agoA correctly done client cert provides mutual authentication (the server's ssl cert and priv key it had when you signed up with it is the one needed to sign in in the future).
- rakoo 12y agoBecause HTTP is stateless and session-less, and cookies are a hack to make it stateful. We introduced the notion of a session where we already had one, in the form of TLS sessions. Note that it would also make APIs much simpler by moving the authentification, authorization and session logic in the certificate, where it actually already is.
- geographomics 12y ago> We introduced the notion of a session where we already had one, in the form of TLS sessions. But that would only apply to HTTPS. An extension to HTTP itself was necessary so state could be maintained for both HTTP and HTTPS. Especially in the mid-1990s (the era when cookies and HTTPS were introduced) when acquiring a CA-signed certificate was cumbersome and expensive.
- rakoo 12y agoThat is true, but I'm one of those guys who believe HTTP-only should die. Even without going as far as that, I believe that as soon as you have to manage some kind of session you're going to have private data flying around, and that should be protected in TLS.
- marcosdumay 12y agoIt's better because you don't send out data that one could use to impersonate you.