News Archive
PhpRiot Newsletter
Your Email Address:

More information

A world without cookies

Note: This article was originally published at Planet PHP on 28 June 2011.
Planet PHP

Imagine a world wide web without cookies. And this might not be the strangest thing, since the use of cookies is severely limited sinceAWednesdayAthe 22nd of June 2011 in the Netherlands. And more countries will follow:A

The LawA

The (Dutch) law, that requires a user to agree before storing data, doesn't only apply on HTTP cookies. But in fact any kind of data that is stored on the users computer. Such as; html5 storage, flash cookies. But also desktop applications,Aetc.. The law also states that cookies "required" for certain functionality, are allowed without confirmation. Personally I don't see how anything will change, with this exception in place. And I wonder how many experts were involved into making this law. But that is a subject for another article perhaps...

What are cookies

Cookies are little packages of information stored in the browser of a website visitor, they can contain "small" amounts of data such as an identifiableAtoken or a user preference.

What purpose do cookies serve

Cookies are very generic and can be used for many things, good and bad. The most popular probably being tracking your activity and advertisement. But they are also used to keep a state between requests and to store a preference. Such as "remember me" at a login form, or perhaps "no I do not want to participate in your survey".

Cookie problems

If When the law becomes international, you are potentially violating laws by simply calling something like: setcookie() without the usersAconsent. There are hacks around the typical HTTP cookies, by using flash cookies for example (Oh and btw, here a guide on how to clear those:A And possibly html5 storage could play a role here (or any of it's derivatives).

Another thing that has been happening, is visitor awareness and thus browser features. More and more people block cookies to stop advertisement tracking, but unfortunately this also prevents a user to use the features he or she wants to use (such as login sessions, etc.). There is an answer for this and quite a few browser vendor's plan on implementing the "Do Not Track" (, or have already done so. But I'm not too happy with it. The downside of "Do Not Track" is that it's voluntary for website owners and advertisement companies to respect this feature.AOther tools include projects such as "Ad Blocker", that only block cookies (and more) for advertisement purposes. It works pretty good, but that is hardly user-friendly.

But, back to "no more cookies"... How do you solve the problem of keeping a state between requests over a stateless protocol?

Some ideasA

Well in short, I have some ideas but definitely no real answers. I don't think there is a real answer just yet.

Let's take the example of a login session. Where you want to offer a secure section to your visitors, where they can (e.g.) read their e-mail, privately.AA few things come to mind:

  • Identifying yourself in every relevant request, using headers for example or an argumentA&userId=42Ain the request. This however has some big problems on its own.
  • Digest authentication on every relevant request.
  • Take a look at other technologies, such as IPv6 and move authentication to a lower level.
  • Perhaps use a commit and rollback system. Where you can do a variety of actions and only your password will be asked in the end, either applying or discarding your actions. Requiring you only to enter your login once. Not the most ideal solution for e-mail though, I have to admit.
  • Or perhaps we need to move away from compl

Truncated by Planet PHP, read more at the original (another 1676 bytes)