<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 08/20/2013 04:11 AM, Matthias
Wessendorf wrote:<br>
</div>
<blockquote
cite="mid:CAAg5f2RYrTTrBE_fS7hb3jgT33T3hRG-=2HH+t58iVxVE_bhig@mail.gmail.com"
type="cite">
<div dir="ltr">hello,
<div><br>
</div>
<div>going over the iOS JIRAs, I found this:</div>
<div><a moz-do-not-send="true"
href="https://issues.jboss.org/browse/AGIOS-6">https://issues.jboss.org/browse/AGIOS-6</a></div>
<div><br>
</div>
<div>and wasn't really sure on 'why' this is needed. A bit more
search made me find this Android ticket:</div>
<div><a moz-do-not-send="true"
href="https://issues.jboss.org/browse/AGDROID-28">https://issues.jboss.org/browse/AGDROID-28</a></div>
<div><br>
</div>
<div>which has a bit more information.</div>
<div><br>
</div>
<div>However, I guess we should discuss if such a 'Cookie mgmt
API' is really needed. For JS I couldn't find a similar
ticket.</div>
<div><br>
</div>
<div>Any thoughts ?</div>
</div>
</blockquote>
Since it might be security season now with summer Push being over
this is a great time to discuss cookies.<br>
<br>
Right now cookies are only "officially" used by the AeroGear
Authentication module. In theory that module can handle the cookie
header on its own and keep us from having to implement a
API/facade/proxy/EnterpriseBuzzwordPattern. <br>
<br>
In practice some websites also set a cookie when you are using HTTP
Basic or HTTP Digest authentication. By the (RFC) spec the way you
handle logging out in this case is to stop sending the header the
logout methods (on Android) only clear the local credentials. As a
convenience these methods do wipe the local cookie store to make
sure any session cookie is wiped out.<br>
<br>
Beyond session/authorization state I havn't heard of webservices
using cookies. (something something stateless). So I'm not sure if
a cookie discussion beyond this scope matter.<br>
<br>
<blockquote
cite="mid:CAAg5f2RYrTTrBE_fS7hb3jgT33T3hRG-=2HH+t58iVxVE_bhig@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>-Matthias<br clear="all">
<div><br>
</div>
-- <br>
Matthias Wessendorf <br>
<br>
blog: <a moz-do-not-send="true"
href="http://matthiaswessendorf.wordpress.com/"
target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
sessions: <a moz-do-not-send="true"
href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
twitter: <a moz-do-not-send="true"
href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
aerogear-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></pre>
</blockquote>
<br>
</body>
</html>