No Cookie for You • Hacker News Board

Re: No Cookie for You

#631

Post by sildur » Fri, Dec 25, 2020, 10:42 AM UTC

knome wrote: post #60

sildur wrote: post #48

Earlier quoted context omitted.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

>a URL parameter I love those systems. Especially when the unwary users share links, accidentally letting other users into the site as them. Or when google indexes it, and in addition to terrible security, the site uses regular GET links to perform site actions, so google deletes the user's content or buys a bunch of stuff as them while walking the links it finds as it indexes in beyond the user's initial account bea…

Hey, I'm not saying it's a good idea. I'm only saying it can be done. I would very much prefer cookies.

Re: No Cookie for You

#632

Post by sildur » Fri, Dec 25, 2020, 10:45 AM UTC

lqet wrote: post #277

sildur wrote: post #48

Earlier quoted context omitted.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Those were great. I hung around a forum around 2004 where someone posted a link to jeans he just bought from a smallish online store - the URL contained the PHP session identifier. Thousands of people had instant access to his address + bank information + purchase history, and could place orders for him.

That's nice, surprise jeans! But yeah, I'm not advocating that, I'm only saying it can be done.

Re: No Cookie for You

#633

Post by sildur » Fri, Dec 25, 2020, 10:46 AM UTC

lloeki wrote: post #85

agency wrote: post #62

Earlier quoted context omitted.

Would this mean that if you shared a URL with someone you would be sharing your session as well?

Yes. Some sites operating like that eventually tried to work around this issue by tying it to the IP, but you can see how that is hopelessly broken anyway.

Maybe it would work with ipv6...

Re: No Cookie for You

#634

Post by sildur » Fri, Dec 25, 2020, 10:49 AM UTC

p410n3 wrote: post #77

sildur wrote: post #48

Earlier quoted context omitted.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

That would break the "remember me" feature for sure, unless you explicitly bookmark the site with the get parameter attached. It also poses a security / opsec issue if anyone non-technical wants to send a link to a friend / co-worker. You may compromise yourself. If people share their screen people would be able to hijack the session too. You won't be able to distinguish device sessions from one another reliably neit…

> You won't be able to distinguish device sessions from one another reliably neither. Think of "log out all other devices".

You could, I think. Passing the session ID in the URL is the same as storing it as a cookie. You can invalidate both in the server.

Link sharing is an issue, for sure. You could tie the session id to the IP, but that doesn't work when people share their IP, which is more and more common every day. IP tied session would work better with IPv6, though.