Re: Handling Cookies is a Minefield

On Mon, Dec 2, 2024 at 10:28 PM Willy Tarreau <w@1wt.eu> wrote:

> Among the needs I've identified quite a few times in the field [...]
>
  2. the difficulty to store arbitrarily long cookies
>

That should be more than difficult: the cookie specs have always explicitly
forbidden arbitrarily long cookies. The practical limits imposed by servers
and the network are even less than the spec allows.

  3. the difficulty to purge all cookies associated with a given session
>

A `Clear-site-data: cookies` response header will do that in browsers these
days, if "given session" means all the cookies for the entire domain and
not some subset of that.

-Dan Veditz