3 ms·
> We introduced the notion of a session where we already had one, in the form of TLS sessions. But that would only apply to HTTPS. An extension to HTTP itself
by geographomics 12y ago
> We introduced the notion of a session where we already had one, in the form of TLS sessions.
But that would only apply to HTTPS. An extension to HTTP itself was necessary so state could be maintained for both HTTP and HTTPS. Especially in the mid-1990s (the era when cookies and HTTPS were introduced) when acquiring a CA-signed certificate was cumbersome and expensive.
- rakoo 12y agoThat is true, but I'm one of those guys who believe HTTP-only should die. Even without going as far as that, I believe that as soon as you have to manage some kind of session you're going to have private data flying around, and that should be protected in TLS.