Hmm. I don't know why you went off on the "cookies" thing. The problem here is that d_i_r_t_y wants to have two parallel conversations within one browser, and you can't do that purely with cookies, because the browser will happily send the identically same cookie to both "session" hits. So you can't use cookies or basic auth, and that means you're stuck with mangled URLs or hidden fields. That, or PSI::ESP, which hasn't been uploaded yet, but I have a feeling it will shortly.

As for why some people "hate cookies (or advise not to use them)", I can give you my take on that. Cookies used for long-term authentication presume the demonstratably false statement of "one user is one browser", as opposed to session cookies, which I actually consider OK unless it breaks something like in d_i_r_t_y's case.

In a given day, I'm popping back and forth between three or four browsers, and some of the browsers I use are on other people's machines, especially in internet cafes and such. So if you're crazy enough to use cookies for auth:

  1. be sure to give me a way not to do that if I know I'm in a shared-browser place
  2. time out the cookie at one day or less (in case I forget to "log out" at an internet cafe in the city I just left)
  3. make it very clear that I'm "logged in"
  4. make it very easy to "log out"
  5. make it very easy to "log in" on another browser
  6. make it possible to use the site entirely without cookies for the very paranoid.
As a good model, look at Amazon. When I'm logged in, at the top of each page it says "If you're not randal, click here". Very clear to me that Amazon thinks my browser is me. And it's easy to log back in on a different browser, and log out on this one. And the site works without cookies at all (if I recall) because they give a session ID in a mangled URL for the particular shopping cart: I just don't get my preferences or "One-Click(tm) Shopping".

Because of that last point, you've got to provide a mangled URL or hidden field solution anyway. So the easiest way out is to go ahead and presume "no cookies", and then slowly add in to the design a way of having longer term recognition, as long as you stay within the guidelines above.

-- Randal L. Schwartz, Perl hacker

In reply to On using cookies for session management... by merlyn
in thread practical aspects of sessions and state by d_i_r_t_y

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.