Create a comprehensive cookie management API / Provide a parameter to enable/disable the usage of cookies
10:11 a.m.
hello,
going over the iOS JIRAs, I found this:
https://issues.jboss.org/browse/AGIOS-6
and wasn't really sure on 'why' this is needed. A bit more search made me
find this Android ticket:
https://issues.jboss.org/browse/AGDROID-28
which has a bit more information.
However, I guess we should discuss if such a 'Cookie mgmt API' is really
needed. For JS I couldn't find a similar ticket.
Any thoughts ?
-Matthias
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
2 p.m.
On Aug 20, 2013, at 3:11 AM, Matthias Wessendorf <matzew(a)apache.org> wrote:
hello,
going over the iOS JIRAs, I found this:
https://issues.jboss.org/browse/AGIOS-6
and wasn't really sure on 'why' this is needed. A bit more search made me
find this Android ticket:
https://issues.jboss.org/browse/AGDROID-28
which has a bit more information.
However, I guess we should discuss if such a 'Cookie mgmt API' is really needed.
For JS I couldn't find a similar ticket.
I remember either a mailing list discussion or maybe just IRC but I explained then that JS
won't do this. Cookie management is done by the browser and there are strict
limitations by domain. There are JS APIs already for creating, modifying and deleting
cookies but the app can only modify cookies with the same domain. There is no need for a
separate API for this in JS since it would just seem silly to JS devs.
Any thoughts ?
-Matthias
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
2:08 p.m.
Here it is
http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Cookie-Management-...
On Aug 20, 2013, at 7:00 AM, Kris Borchers <kris(a)redhat.com> wrote:
On Aug 20, 2013, at 3:11 AM, Matthias Wessendorf <matzew(a)apache.org> wrote:
> hello,
>
> going over the iOS JIRAs, I found this:
> https://issues.jboss.org/browse/AGIOS-6
>
> and wasn't really sure on 'why' this is needed. A bit more search made me
find this Android ticket:
> https://issues.jboss.org/browse/AGDROID-28
>
> which has a bit more information.
>
> However, I guess we should discuss if such a 'Cookie mgmt API' is really
needed. For JS I couldn't find a similar ticket.
I remember either a mailing list discussion or maybe just IRC but I explained then that
JS won't do this. Cookie management is done by the browser and there are strict
limitations by domain. There are JS APIs already for creating, modifying and deleting
cookies but the app can only modify cookies with the same domain. There is no need for a
separate API for this in JS since it would just seem silly to JS devs.
>
> Any thoughts ?
>
> -Matthias
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
> sessions: http://www.slideshare.net/mwessendorf
> twitter: http://twitter.com/mwessendorf
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
2:20 p.m.
On Tue, Aug 20, 2013 at 2:00 PM, Kris Borchers <kris(a)redhat.com> wrote:
On Aug 20, 2013, at 3:11 AM, Matthias Wessendorf <matzew(a)apache.org>
wrote:
hello,
going over the iOS JIRAs, I found this:
https://issues.jboss.org/browse/AGIOS-6
and wasn't really sure on 'why' this is needed. A bit more search made me
find this Android ticket:
https://issues.jboss.org/browse/AGDROID-28
which has a bit more information.
However, I guess we should discuss if such a 'Cookie mgmt API' is really
needed. For JS I couldn't find a similar ticket.
I remember either a mailing list discussion or maybe just IRC but I
explained then that JS won't do this. Cookie management is done by the
browser and there are strict limitations by domain. There are JS APIs
already for creating, modifying and deleting cookies but the app can only
modify cookies with the same domain. There is no need for a separate API
for this in JS since it would just seem silly to JS devs.
+1
thanks for finding the thread - I tried to recall as the JIRA had not the
details listed
Any thoughts ?
-Matthias
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
3:53 p.m.
On 08/20/2013 04:11 AM, Matthias Wessendorf wrote:
hello,
going over the iOS JIRAs, I found this:
https://issues.jboss.org/browse/AGIOS-6
and wasn't really sure on 'why' this is needed. A bit more search made
me find this Android ticket:
https://issues.jboss.org/browse/AGDROID-28
which has a bit more information.
However, I guess we should discuss if such a 'Cookie mgmt API' is
really needed. For JS I couldn't find a similar ticket.
Any thoughts ?
Since it might be security season now with summer Push being over
this
is a great time to discuss cookies.
Right now cookies are only "officially" used by the AeroGear
Authentication module. In theory that module can handle the cookie
header on its own and keep us from having to implement a
API/facade/proxy/EnterpriseBuzzwordPattern.
In practice some websites also set a cookie when you are using HTTP
Basic or HTTP Digest authentication. By the (RFC) spec the way you
handle logging out in this case is to stop sending the header the logout
methods (on Android) only clear the local credentials. As a convenience
these methods do wipe the local cookie store to make sure any session
cookie is wiped out.
Beyond session/authorization state I havn't heard of webservices using
cookies. (something something stateless). So I'm not sure if a cookie
discussion beyond this scope matter.
-Matthias
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
3895
days inactive
3895
days old
4 comments
3 participants
participants (3)
-
Kris Borchers -
Matthias Wessendorf -
Summers Pittman