Live data from Hacker News

Handling cookies is a minefield

grayduck.mn

91–100 of 270 posts

Re: Handling cookies is a minefield

#91
post #68

Earlier quoted context omitted.

And yet the html5 syntax variation survived (with all it's weird now-codified quirks), and the simpler, stricter xhtml died out. I'm not disagreeing with out; it's just that being flexible, even if it's bad for the ecosystem is good for surviving in the ecosystem.

There was a lot of pain and suffering along the way to html5, and html5 is the logical end state of postel's law: every possible sequence of bytes is a valid html5 document with a well-defined parsing, so there is no longer any room to be more liberal in what you accept than what the standard permits (at least so far as parsing the document).

Getting slightly off topic, but I think it's hard to find the right terminology to talk about html's complexities. As you point out, it isn't really a syntax anymore now that literally every sequence is valid. Yet the parsing rules are obviously not as simple as a .* regex. It's syntactically simple, but structurally complex? What's the right term for the complexity represented by how the stack of open elements interacts with self-closing or otherwise special elements?

Anyhow, I can't say I'm thrilled that some deeply nested subtree of divs for instance might be closed by a open-button tag just because they were themselves part of a button, except when... well, lots of exceptions. It's what we have, I guess.

It's also not a (fully) solved problem; just earlier this year I had to work around an issue in the chromium html parser that caused IIRC quadratic parsing behavior in select items with many options. That's probably the most widely used parser in the world, and a really inanely simple repro. I wonder whether stuff like that would slip through as often were the parsing rules at all sane. And of course encapsulation of a document-fragment is tricky due to the context-sensitivity of the parsing rules; many valid DOM trees don't have an HTML serialization.

Re: Handling cookies is a minefield

#92
post #71

Earlier quoted context omitted.

> and they're server-readable too now, just indirectly. Could you point me to more reading about this? It's the first time I've heard of it

I think they mean that you can always send back the content of a localstorage property with javascript grabbing the value and sending another request back with it in the body. Since the front end is going to run any javascript the server sends it (disregarding adblockers at least), it's sort of a more indirect version of Set-Cookie.

Yeah, that's what I meant. There's no built in support; but it's indirectly readable since client-side JS can read it.

Re: Handling cookies is a minefield

#93
post #38

Earlier quoted context omitted.

Not really. A lot of essential third party Rust crates and projects have "weird" names, eg. "nom", "tokio", etc. You can see that from the list of most downloaded crates [1]. This one just happens to have been owned and maintained by core Rust folks and used in a lot of larger libraries. This is more the exception than the rule. It's a given that you should do due diligence on crates and not just use the first name t…

> Rust crates need namespacing to avoid this and similar problems going forward. It hasn't been implemented despite crowd demanding it on HN for years because it won't solve the problem (namespace squatting is going to replace name squatting and tada! you're back to square one with an extra step).

php deals with this by using the username/organization name of a repository as the namespace name of packages. At least then you're having to squat something further up the food chain.

Re: Handling cookies is a minefield

#94
post #38

Earlier quoted context omitted.

Not really. A lot of essential third party Rust crates and projects have "weird" names, eg. "nom", "tokio", etc. You can see that from the list of most downloaded crates [1]. This one just happens to have been owned and maintained by core Rust folks and used in a lot of larger libraries. This is more the exception than the rule. It's a given that you should do due diligence on crates and not just use the first name t…

A sibling comment talked about “UwU names”. Not sure exactly if they are referring to “tokio” or something else. But if it’s tokio, they might find this informative: > I enjoyed visiting Tokio (Tokyo) the city and I liked the "io" suffix and how it plays w/ Mio as well. I don't know... naming is hard so I didn't spend too much time thinking about it. https://www.reddit.com/r/rust/comments/d3ld9z/comment/f03lnm... Fro…

[flagged]

Re: Handling cookies is a minefield

#95
That is a bit of a minefield, I agree…

The way around this, as a developer, is URL-safe-base64 encode the value. Then you have a bytes primitive & you can use whatever inner representation your heart desires. But the article does also note that you're not 100% in control, either. (Nor should you be, it is a user agent, after all.)

I do wish more UAs opted for "obey the standard" over "bytes and an prayer on the wire". Those 400 responses in the screenshots … they're a conforming response. This would have been better if headers had been either UTF-8 from the start (but there are causality problems with that) or ASCII and then permitted to be UTF-8 later (but that could still cause issues since you're making values that were illegal, legal).

Re: Handling cookies is a minefield

#96
post #35

Cookies seem to be a big complicated mess, and meanwhile are almost impossible to change for backwards-compatibility reasons. Is this a case to create a new separate mechanism? For example a NewCookie mechanism could be specified instead, and redesigned from the ground-up to work consistently. It could have all the modern security measures built-in, a stricter specification, proper support for unicode, etc.

The DOM & URL are the safest places to store client-side state. This doesn't cover all use cases, but it does cover the space of clicking pre-authorized links in emails, etc. I spend a solid month chasing ghosts around iOS Safari arbitrarily eating cookies from domains controlled by our customers. I've never seen Google/Twitter/Facebook/etc domains lose session state like this.

Safari is a lot more strict about cookies than Chromium or Firefox, it will straight up drop or ignore (or, occasionally, truncate) cookies that the other two will happily accept.

I had hoped when writing this article that Google would look at Safari and see that it was always strict about feel comfortable about changing to be the same. But doing so now would unfortunately break too many things for too many users.

Re: Handling cookies is a minefield

#97
post #38

Earlier quoted context omitted.

Not really. A lot of essential third party Rust crates and projects have "weird" names, eg. "nom", "tokio", etc. You can see that from the list of most downloaded crates [1]. This one just happens to have been owned and maintained by core Rust folks and used in a lot of larger libraries. This is more the exception than the rule. It's a given that you should do due diligence on crates and not just use the first name t…

A sibling comment talked about “UwU names”. Not sure exactly if they are referring to “tokio” or something else. But if it’s tokio, they might find this informative: > I enjoyed visiting Tokio (Tokyo) the city and I liked the "io" suffix and how it plays w/ Mio as well. I don't know... naming is hard so I didn't spend too much time thinking about it. https://www.reddit.com/r/rust/comments/d3ld9z/comment/f03lnm... Fro…

Just want to point out that location names are used for codenames because they cannot be trademarked

Big tech uses them instead of wasting legal time and money having to clear a new name that's temporary or non-public.

Changing the name to Tokio removes this benefit and still leaves it disconnected from its purpose.

Re: Handling cookies is a minefield

#98
post #69

Earlier quoted context omitted.

In both cases (cookie vs localStorage) you're really just storing your data as a string value, not truly a JSON object, so whether you use a cookie or localStorage is more dependent on the use case. If you only ever need the stored data on the client, localStorage is your pick. If you need to pass it back to the server with each request, cookies.

Combine local storage with service worker, so you pass the data to the server if needed. Completely without setting cookies.

And if I don't want any javascript to see my values, ever? Or how do you handle CSRF?

Re: Handling cookies is a minefield

#99

That is a bit of a minefield, I agree… The way around this, as a developer, is URL-safe-base64 encode the value. Then you have a bytes primitive & you can use whatever inner representation your heart desires. But the article does also note that you're not 100% in control, either. (Nor should you be, it is a user agent, after all.) I do wish more UAs opted for "obey the standard" over "bytes and an prayer on the wire"…

> URL-safe-base64

And make sure to specify what exactly you mean by that. base64url-encoding is incompatible with base64+urlencoding in ~3% of cases, which is easily missed during development, but will surely happen in production.

Post reply on HN