Search Parameters

Question

I have a Detail Search form on the Startpage, where the user have many Search options available.

What would be the best practice to keep Search paramets for the user Session. What are the Pros and Cons if the put them in

• URL
• Session
• Cookie

What should be used as Best practice.

Answer 1

I'd say a session is the best option. If you have several pages, you most likely will need to keep some global state -- the alternative being the user resubmitting all the previous data when he moves to the next page.

That said, you cannot just use a session that relies on a cookie to store the session identifier, at least not without some extra data that is in fact passed around between the several pages as a hidden field or a URL parameter.

The problem is that with just a cookie you won't have web conversations, you have a global cookie that's shared between all the tabs/windows in the browser. If the user opens a new tab and starts a new search, the session cookie will be replaced and the session in the other tab will be lost.

So either you:

• Pass the session id in the URL instead of using a cookie (beware of session fixation, though).
• Include an extra GET parameter or hidden field that identifies the conversation.

Answer 2

I'm going to plump for Cookie on the basis that URL persistence will make all your URLs ugly and poor for link sharing; not only that but some devices might balk at very long URLs (you say there are a lot of options). Session persistence requires cookies anyway; or query string persistence to maintain the state (back to link-sharing and ugly URL problems).

With a cookie you can store a lot of data (well, within reason) and it doesn't affect your urls.

However - if search parameter persistence is crucial to your application, then you should have a fallback that detects whether cookies are available, and resorts to URL persistence if not.

Answer 3

Best practice really depends on the scenario (including business case, programming language, etc.). However, here are some high level pros/cons.

URL Pros: easy to read/write
URL Cons: user can easily manipulate them causing unintended results, nasty URLs

Session pros: should be pretty easy to read/write programmatically (depending on the language), don't have to worry about parameters in a URL
Session cons: takes up more memory (may be negligible depending on the data)

Cookie pros: doesn't take up memory
Cookie cons: must read/write to a file, user could delete cookies at any time (mid-session), cookies shared within the browser (1 cookie for any number of sessions)