Re^2: "omniscient debugging" for Perl

Replies are listed 'Best First'.
Eliminate server-side state to obviate cookies by tmoertel (Chaplain) on Jul 05, 2005 at 16:40 UTC
How does this eliminate the need for cookies? ... No matter how much you can save on the server side, HTTP is stateless and you need some piece of data coming from the client to indicate that this request is tied to a previous request ... If you can represent the entire state compactly enough, you can send it back to the client with every response and receive it from the client with every request. Now you don't need to store any state on the server, nor do you need cookies on the clients. For example, take a look at Web Authoring System Haskell. It records a journal of client-server interactions, sends this journal to the client as part of every response (in a hidden field in an HTML form), and when the form is submitted, it replays the journal on the server to recreate the state. Cheers, Tom Tom Moertel : Blog / Talks / CPAN / LectroTest / PXSL / Coffee / Movie Rating Decoder	[reply]
Re: If you do away with server-side state, you don't need cookies by mpeters (Chaplain) on Jul 05, 2005 at 16:48 UTC
Whether you send the data to the client as a hidden field in a form, or as a cookie it's basically the same thing. And by using a cookie you can be sure that the data will be in every request the user sends (GET's, links, images, media, etc) from then on, not just the results of a form. While this would reduce the need for server side storage of sessions, this can already be done. There are lots of people who instead of sending a session id in the cookie (or hidden field) will send a serialized version of an object or hash which they can then unserialize at the next request. -- More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk. -- Bruce Schneier	[reply]
Re^2: If you do away with server-side state, you don't need cookies by tmoertel (Chaplain) on Jul 05, 2005 at 17:07 UTC
Whether you send the data to the client as a hidden field in a form, or as a cookie it's basically the same thing. Not really. The complete-state-in-a-form method allows for easy session forking. It also allows users to undo state transitions by backing up into the browser history. Cookies don't support either of these. Cheers, Tom Tom Moertel : Blog / Talks / CPAN / LectroTest / PXSL / Coffee / Movie Rating Decoder	[reply]
Re^3: If you do away with server-side state, you don't need cookies by adrianh (Chancellor) on Jul 06, 2005 at 10:49 UTC
Re: Eliminate server-side state to obviate cookies by hardburn (Abbot) on Jul 05, 2005 at 16:55 UTC
This sounds horribly insecure to me. How do you stop the client from changing the state into one it shouldn't. I think I'll keep cookies with a randomly-generated ID crossreferenced to a database. "There is no shame in being self-taught, only in not trying to learn in the first place." -- Atrus, Myst: The Book of D'ni.	[reply]
Re^2: Eliminate server-side state to obviate cookies by tmoertel (Chaplain) on Jul 05, 2005 at 17:10 UTC
How do you stop the client from changing the state into one it shouldn't? It's easy: cryptographically sign the state. Tom Moertel : Blog / Talks / CPAN / LectroTest / PXSL / Coffee / Movie Rating Decoder	[reply]
Re^3: Eliminate server-side state to obviate cookies by hardburn (Abbot) on Jul 05, 2005 at 17:37 UTC
Re^4: Eliminate server-side state to obviate cookies by tmoertel (Chaplain) on Jul 05, 2005 at 18:50 UTC
Re^2: Eliminate server-side state to obviate cookies by Anonymous Monk on Jul 05, 2005 at 17:14 UTC
How do you stop the client from changing the state into one it shouldn't. Encryption `Storing the session state in the form sent back to the browser may have security implications if it reveals internal server information. In addition, the session state often contains sensible user input, like passwords. WASH/CGI addresses both concerns by providing a one-time pad encryption for the session state.` 20050705 Janitored by Corion: Moved (broken) link from `a` tag into `[http://`	[reply] [d/l]
Re^3: Eliminate server-side state to obviate cookies by tilly (Archbishop) on Jul 05, 2005 at 20:51 UTC
Re^4: Eliminate server-side state to obviate cookies by thor (Priest) on Jul 07, 2005 at 03:32 UTC
Re^3: Eliminate server-side state to obviate cookies by hardburn (Abbot) on Jul 05, 2005 at 17:39 UTC


more useful options
	PerlMonks