HTTP/2 Is Done • Hacker News Board

Re: HTTP/2 Is Done

#141

Post by ecthiender » Thu, Feb 19, 2015, 7:32 PM UTC

stephenr wrote: post #48

MichaelGG wrote: post #34

Earlier quoted context omitted.

HTML5 has local storage, so you can put auth tokens in there and only send them when you need them, versus on every request.

So rather than just using cookies effectively, you can make your application absolutely dependant on both JavaScrip and XHR?

I agree with you completely. Cookies are an older technology and is well supported in all kinds of browser. Plus it does the client side of session management for you(sending the tokens on every request). Localstorage is newer technology and might not be feasible in all situations. Plus JS+XHR are also not available to all kinds of users. (People using Tor, NoScript etc).

Also, I don't see the advantage of storing session/auth tokens in localstorage over cookies. Both are stored in plain text, and can be read if somehow it is obtained. Also, using localstorage means writing your own client-side implementation of doing the session management.

I also don't see the advantage of using session tokens in URLs. Anyway cookies are included as part of header of the HTTP request, you don't have to have your application send session trackers. I think both are functionally same and the tokens in URLs just does not look good!

And public/private key-based signing system is still not there yet, unless we simplify some UX issues about having private/public keys for every user, we are not getting there.

So, it looks like, to me, there is no really effective alternative for doing sessions apart from cookies (even in HTTP/2)?!

Re: HTTP/2 Is Done

#142

Post by IgorPartola » Fri, Feb 20, 2015, 2:12 PM UTC

josteink wrote: post #91

IgorPartola wrote: post #89

Earlier quoted context omitted.

I am with you up to letting people use unencrypted HTTP. I assume people in this can use telnet instead of ssh because it is simpler. No, browsers should drop support for unencrypted HTTP soon after Let's Encrypt goes live.

> browsers should drop support for unencrypted HTTP soon after Let's Encrypt goes live. To the people who keep insisting everything needs encryption: No it doesn't. Fuck off! You don't see me forcing PGP on on your email, do you? No? Fine, then let us non-weirdoes keep using plain HTTP where we want it, where we have determined that it is a good fit for our needs. Besides, this is purely a theoretical concern because…

I assume you use telnet instead of ssh too. Once you do a little research and spend a little time figuring out what can actually be done (and is done constantly) to the unencrypted HTTP (anything from user tracking, to ad injections, to identity theft), you will realize just how wrong you are. Yes, HTTP needs to die. Sorry it's taking you a while to see it.

Re: HTTP/2 Is Done

#143

Post by lutoma » Sat, Feb 21, 2015, 6:21 PM UTC

hueving wrote: post #53

ecthiender wrote: post #32

Earlier quoted context omitted.

Excuse my ignorance, but how can I do session management without using cookies? I tried searching on the net, but it doesn't seem to give any concrete/valid results. Can you give me any pointers? Edit: I do use OAuth2.0 on my services and use Mozilla Persona to manage user logins, but I am not clear how can I keep sessions between requests if I don't use cookies.

You can carry the session ID in the URL. This also has the benefit of eliminating XSRF. The downside is that you have a horrendous URL if that type if thing bothers you, and you can't have a "remember me" check box in your login.

That's a horrible suggestion, it's not 1999 anymore…

Re: HTTP/2 Is Done

#144

Post by solarizde » Mon, Feb 23, 2015, 4:04 PM UTC

EugeneOZ wrote: post #70

bgentry wrote: post #16

It's time to begin the long process of unwinding all the hacks that we've built to make HTTP/1.1 fast. No more concatenation of static assets, no more domain sharding. The future looks more like this, as the default, with no special effort required: https://http2.golang.org/gophertiles May nobody else have to suffer through writing an interoperable HTTP/1.1 parser!

nginx doesn't support http2, apache too.. So maybe it's time to make some efforts to implement it on servers first. Maybe make some donations to apache, nginx dev. teams to speed up this process.

Yes it's a pitty, Apache and mod SPDY is really a pain currently.