Hacker News Reader

Comment by prasadjoglekar | Hacker News Reader

The first sentence

> HTTP cookies were never intended for session management

Seems odd. IIRC that's exactly what they were meant for. State management for http which is stateless. Am I missing some history here?

View on HN

> This document specifies a way to create a stateful session with Hypertext Transfer Protocol (HTTP) requests and responses. It describes three new headers, Cookie, Cookie2, and Set-Cookie2, which carry state information between participating origin servers and user agents. The method described here differs from Netscape's Cookie proposal [Netscape], but it can interoperate with HTTP/1.0 user agents that use Netscape's method. (See the HISTORICAL section.)

RFC 2965, make of it what you want but I agree with you. Actually, RFC 2109 is even older (1997) and says more or less the same.

I could be wrong, but I believe the author is referring to cookies being used for session authentication as opposed to general session management.

That's still exactly what they they were invented, though. The very first example in RFC2109 is literally for tying a session to a login.

The "abstract idea" of a cookie is an identifier that it lets a server consider requests within a larger series of requests by the same person, but the fact that it can do that at all also meant that it solved the whole "how do we know whether this user is logged in without every page request after login needing to be a POST that includes the user's name and password again".

I'm starting to look at every technology change Google makes as a way for them to entrench their moat.

The faster we get an antitrust breakup of Google from Chrome and Android, the better.

Reply on news.ycombinator.com