using Cookie-free Domains for Components

views:

answers:

using Cookie-free Domains for Components

I was looking at the post here which says

When the browser makes a request for a static image and sends cookies together with the request, the server doesn't have any use for those cookies. So they only create network traffic for no good reason.

Although I tend not to use cookies at all, my doubt is I used to think that the server creates the cookies to store the session varialbles etc and sends to the client. But this statement says the reverse of that. I don't quiet understand what is the need for the browser to create and send cookies with the request, to me it doesn't make any sense?.

Can anyone please correct me?

Thanks/.

The server creates the cookies, yes, but the browser has to send existing cookies back to the server on every request - that is the only way the web server can identify the user (since HTTP is stateless). Without cookies, a browser is potentially a completely different person than the last request.

Typically a cookie is just a session ID which is mapped to a database entry with all of the session data.

The idea of cookieless domains is to have static resources (that is.. files that rarely/never change, regardless of session state, etc) served without the browser having to send cookie data (which is useless to static content anyway).

Matt 2010-05-05 10:24:04

but that what we use sessions in web apps right? to identify the user on subsequent requests?

JPro 2010-05-05 10:28:50

Sessions are generally supported by cookies. The only other way you could persist the session across requests is if you appended the session ID to each link, or something similar. In either strategy, the browser has to send that session ID back to the server on each request, otherwise the session cannot exist.

Matt 2010-05-05 10:29:56

Exactly, the browser has to send the session ID to the server. But what I am trying to say is , it infact doesn't send the cookie itself?

JPro 2010-05-05 10:45:12

@JPro - the server *creates* the cookie in the first place (using the `Set-Cookie:` header). After that happens, that browser has to send the cookie *back* to the server (using the `Cookie:` header) on each request. In this example, the cookie is holding the session ID. So the cookie is the method of transport to get the session ID back to the server.

Matt 2010-05-05 17:35:35

ansaurus

tags:

views:

answers:

using Cookie-free Domains for Components

related questions