Re: [aerogear-dev] Create a comprehensive cookie management API / Provide a parameter to enable/disable the usage of cookies

On 08/20/2013 04:11 AM, Matthias Wessendorf wrote: Since it might be security season now with summer Push being over this is a great time to discuss cookies. Right now cookies are only "officially" used by the AeroGear Authentication module. In theory that module can handle the cookie header on its own and keep us from having to implement a API/facade/proxy/EnterpriseBuzzwordPattern. In practice some websites also set a cookie when you are using HTTP Basic or HTTP Digest authentication. By the (RFC) spec the way you handle logging out in this case is to stop sending the header the logout methods (on Android) only clear the local credentials. As a convenience these methods do wipe the local cookie store to make sure any session cookie is wiped out. Beyond session/authorization state I havn't heard of webservices using cookies. (something something stateless). So I'm not sure if a cookie discussion beyond this scope matter.