Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handling cookies is a minefield

grayduck.mn

Post reply on HN
Print view View original

161–170 of 270 posts

Re: Handling cookies is a minefield

#161

Post by jamesfinlayson »

treflop wrote: post #131
maxwellg wrote: post #107

Cookies are filled with weird gotchas and uncomfortable behavior that works 99.95% of the time. My favorite cookie minefield is cookie shadowing - if you set cookies with the same name but different key properties (domain, path, etc.) you can get multiple near-identical cookies set at once - with no ability for the backend or JS to tell which is which. Try going to https://example.com/somepath and entering the follow…

At work, whoever designed our setup put the staging and dev environments on the same domain and the entire massive company has adopted this pattern. What a colossal mistake.

I had the option to re-use the prod domain for non-prod a few years ago (the company's other two projects use the prod domain for all non-prod environments).

I didn't really think about cookies back then but it just felt like a generally bad idea because disastrously messing up a URL in some config or related service would be much easier.

Re: Handling cookies is a minefield

#162

Post by naasking »

telgareith wrote: post #153
bpicolo wrote: post #148

Earlier quoted context omitted.

Server can store session state

Server side session state for more than authentication is way worse than "code smell." It requires a ping to a shared data source on every request. And, the same one for all of them. No sharding, No split domains... That gets expensive fast!

You just described how the whole web operates. It works just fine.

Re: Handling cookies is a minefield

#163

Post by MBCook »

naasking wrote: post #162
telgareith wrote: post #153

Earlier quoted context omitted.

Server side session state for more than authentication is way worse than "code smell." It requires a ping to a shared data source on every request. And, the same one for all of them. No sharding, No split domains... That gets expensive fast!

You just described how the whole web operates. It works just fine.

Even if you want client side, we have better ways now than cookies.

Re: Handling cookies is a minefield

#164

Post by baggy_trough »

seandoe wrote: post #160
baggy_trough wrote: post #144

Earlier quoted context omitted.

How would you use the Authorization header to implement server side session data?

I think they mean storing an identifier in local or session storage and then sending it in the header.

It doesn't work with basic multi page sites though.

Re: Handling cookies is a minefield

#165

Post by MBCook »

j16sdiz wrote: post #156
IgorPartola wrote: post #135

Cookies need to die. Their only legitimate use is with for which we have the Authentication header. Having a standard way to authenticate into a website in a browser would be amazing, just too bad that Basic and Digest auth wasn’t good enough at the time. As a bonus we could get Persona-style passwordless future.

How about user preference without logging in? Are you suggesting create a trillion throwaway accounts?

What about things like local storage?

Re: Handling cookies is a minefield

#166

Post by MBCook »

robgibbons wrote: post #60
recursive wrote: post #51

Earlier quoted context omitted.

JSON is explicitly a string serialization format.

Right, I meant it's not a JavaScript object. It's serialized into a string in any case, no matter which API you're stuffing it into. So it's a bit of a non-sequitur for the parent to suggest that it's somehow weird to store JSON in a cookie, but not in localStorage. It's all just strings.

I find it weird too. I’ve always considered cookies like very stupid key value stores.

It would never occur to me to put something more than a simple token in a cookie. A username, and email address, some opaque thing.

The idea of trying to use it for arbitrary strings just seems weird to my intuition, but I don’t really know why. Maybe just because when I was learning about them long ago I don’t remember seeing that in any of the examples.

Re: Handling cookies is a minefield

#167

Post by MBCook »

lambdaone wrote: post #67
0x073 wrote: post #19

IT IS a mess, but I never saw json inside a cookie. For json I use local storage or indexeddb.

You're really going to hate it when you learn about JSON Web Tokens, which exist exactly to hack past this sort of problem.

But at least they’re base 64 encoded so you don’t have to worry about the special characters

Re: Handling cookies is a minefield

#168

Post by marcosdumay »

somat wrote: post #129
marcosdumay wrote: post #21

Earlier quoted context omitted.

The problem with Postel's law is exactly that the sender is never conservative, and will tend to use any detail that most receivers accept.

So the problem with Postel's law is that people don't follow Postel's law?

The problem is that it's a prisoner's dilemma. And you can't cooperate on a prisoner's dilemma against the entire world.

Re: Handling cookies is a minefield

#169

Post by kijin »

NBJack wrote: post #132
teaearlgraycold wrote: post #130

Earlier quoted context omitted.

Using the path field is a code smell

Can you elaborate? I'm having a tough time finding references to that. (Disclaimer: I'm not an avid JS developer)

It means that you are setting cookies on whatever page you're on, without considering whether the cookie will be consistently accessible on other pages.

For example, you set the currency to EUR in /product/123, but when you navigate to /cart and refresh, it's back to USD. You change it again to EUR, only to realize in /cart/checkout that the USD pricing is actually better. So you try to set it back to USD, but now the cookie at /cart conflicts with the one at /cart/checkout because each page has its own cookie.

Re: Handling cookies is a minefield

#170

Post by thaumasiotes »

michaeljsmith wrote: post #146
thaumasiotes wrote: post #122

Earlier quoted context omitted.

What do the British call biscuits? https://chefjar.com/wp-content/uploads/2021/05/popeyes-biscu...

The closest thing is https://en.wikipedia.org/wiki/Scone .

I've had something (in the US) that was called a "scone", and it was rigid, which disqualifies it from being similar to a biscuit in my mind.

Is that generally true of scones?

Post reply on HN