Web Session Cookies
This cluster centers on debates about using cookies for web session management, including server-side vs. client-side sessions, security risks like XSS and session hijacking, and alternatives such as HTTP Auth or localStorage.
Activity Over Time
Top Contributors
Keywords
Sample Comments
I think he's talking about a server-side session store (or perhaps an encrypted cookie payload)
What's the difference between this and just storing a long session ID in cookies?
That still keeps the session and login cookie vulnerable right?
There are ways to maintain a session without a cookie, but cookie is very convenient so that is mostly what is used.
Use Session. It's just as easy, and more secure + decentralized. So it's better in just about every way.
Hint: many web stacks suppport server-side sessions. Via cookies.
Wouldn't a secure cookie be enough for this?
Session support is what cookies were supposed to solve, a proper support would make things simpler and not allow to abuse cookies for other things.
What's the browser app scenario in which having a session is a liability, but having a stored HTTP Auth credential isn't?
Is this valid even if you use session instead of cookie?