« first day (2845 days earlier)      last day (2328 days later) » 

00:00
does the cookie get sent to the server ever?
er, read by the server?
it gets sent
then just use localStorage
not during the creation process
Yes, it gets used later
afaik localStorage is forever
so if you just intend to keep a cart for someone, it should work fine
if you intend to keep it local
This is the number of the cart on the database
00:02
40
A: Javascript Cookie with no expiration date

NimirYou can do as the example on Mozilla docs: document.cookie = "someCookieName=true; expires=Fri, 31 Dec 9999 23:59:59 GMT"; P.S Of course, there will be an issue if humanity still uses your code on the first minute of year 10000 :)

I mean, you can't make a non expiring cookie in one go
you either have to keep updating it, or set it within bounds of the browsers.. which may change I guess
I remember researching heavily local storage and deciding against it, but now I can't for the life of me remember what my reasoning was
The cookie only contains an integer corresponding to the cart. Nothing else. The rest is on the database.
I think it had something to do with hardware performance, but I've forgotten now
@forresthopkinsa Trying this example now
@forresthopkinsa hoping it has full support with other browsers
I don't know, I've never tried it
there was a bug preventing setting it above 2032 or something
but that's fixed I guess.
still. no reason to set a longer than normal lasting cookie
yeah, I was trying to set it to 2032 exactly
00:09
there are other, more suitable storage solutions
my problem was I was trying to write it in integer form, but the browser only seems able to read it in full date form
@JonathonPhilipChambers definitely consider the fact that you're not using cookies how they're meant to be used
@forresthopkinsa and how are they meant to be used?
!!wikipedia http cookie
@forresthopkinsa That didn't make much sense. Use the !!/help command to learn more.
00:12
useless
they're meant to keep state in a session
Yes, that's what my cookie does
so your session is expected to last decades?
no, but if it takes that long for someone to decide to buy something, I don't want to limit them
ok you should limit them
00:16
if you want that info to be attached to a user for a long time then you need to be using authenticated data
it's not practical to keep browser-specific user-independent shopping cart state for decades
to be clear, the cookie contains the equivalent of "your shopping cart is shopping cart number 27" and the website's database contains "shopping cart number 27 contains..."
what
so you want your database to be holding onto 20-year-old shopping carts
This cookie contains one integer
that's arguably worse
Sure. In 20 years the space required to hold such small things will be so cheap
Each cart is merely a string
00:19
you haven't alleviated the security risk by doing that
Idk if the cost of memory is the issue lol
yeah this isn't about storage pricing
I don't imagine that your shopping carts will even take up a significant amount of space now
people generally don't want their online shopping activity to be public
more importantly, though, why do you want to populate your database with useless data
people are not going to come back in 20 years to finish their transaction
00:22
either store it client-side or let it expire
Or don't use a guessable session key
Once the order is completed, the cart is emptied
ok wellll you wanted an explanation, there it is. You wanna waste tons of rows in your database with data that will never expire or be used, that's your prerogative lol
if I store a million lines, and one of them gets used, that's a big win for me
but don't be surprised when the technology you're using isn't built to support those purposes
alrighty man
00:24
What was the original question?
he wanted to make non-expiring cookies
@forresthopkinsa wiki
!!wiki http cookie
if that works?
An HTTP cookie (also called web cookie, Internet cookie, browser cookie, or simply cookie) is a small piece of data sent from a website and stored on the user's computer by the user's web browser while the user is browsing. Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user's browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the...
ayy thanks
nice
00:24
I never said non-expiring cookie
I thought he just wanted to store the cart id in a cookie
Then use that to grab it from the database
I said maximum life cookie
ok he wants it with the "longest possible expiry"
ok so a cookie that'll last to the 64-bit overflow
for all intents and purposes, this is a non-expiring cookie
I've already done that, but the cookie keeps expiring
1. Replace the cart id with a non-guessable key
00:26
stack overflow is filled with duplicates of:
"How do I create a non-expiring cookie"
"You can't"

I wouldn't bring such a heavily duplicated question into this chat
the answers to those questions answer yours just as well
2. allow users to associate a username and password with the key
so they can retrieve it if they lose the cookie
jwt + localStorage
😉
username and password functionality can come later. For now, I'm just allowing people to purchase anonymously.
00:28
then just let the cookie expire after like a week
your priorities seem really out of order pal
who's to say that you won't end up completely redesigning your cookie system next week when you create a user system, thereby invalidating the two that were made between now and then
this is pre-optimization
if the trouble is just creating the cookie.. and you're not directly accessing them on the server. the solution is clear
I'm annoyed. I think we've presented you with the solutions. I'm gonna head home, talk to you guys tomorrow
Forrest, I don't mean to offend you. I just like to take the time to understand the solutions before I implement them
Implementing the correct solution is not enough. I need to understand why it's correct so I don't undermine it later.
that's totally fair. ttyl
00:33
there are only two clear advantages to cookies imo. if you want to read them on the server (they're pretty much always sent) and if you want automatic expiry (which is a no brainer)
There have been multiple solutions presented, but I can only pick one
so if that isn't true for you, just use localStorage
and send the id with xhr or fetch
rlemon, I'm actually leaning towards your solution. I just remember explicitly deciding against it, but cannot for the life of me remember what my reasoning was
If I swap out a cookie id for local storage id, what server reading things will I no longer be able to do?
some of the syncs might include cookies and not localStorage? but that's edge case shit. I wouldn't worry about it
@JonathonPhilipChambers localStorage isn't included with the request, cookies are. so it depends on how you do things currently?
This has given me a lot to think about. I'm going to do some more research
Anyone got a good link to the benefits of cookies over local storage for me to check before I get rid of the cookie?
00:40
You really probably don't want GET /cart/:id to be part of your api though
I'm approaching this from a jwt point of view.
session shit, idk. but it should copy over.
The difference is that cookies get sent with every request
jwt and sessions are the same ends
the basic distinction for you, between localStorage and cookies, is I guess pre rendering.
with cookies you can actually do things on the server before the page is sent.
Rob
Rob
@JonathonPhilipChambers The major difference is that you can set a cookie to be unreadable by javascript, which protects against XSS. If someone were able to inject javascript into your site, they'd be able to steal user's tokens
00:42
The main difference is that in theory you can make a stateless server
with localStorage, you can load the page then load teh info
That's the main selling point of JWT over sessions
yea, but getting away from JWT, don't wanna confuse.
Which is a fairly weak selling point, because if you want to be able to invalidate JWT tokens, you still need state on the server.
just between local and cookies
00:43
Oh, thought JWT was the topic
cookies are sent on every request. local is .. well , local
I feel like maybe bringing up JWT was a bad idea
so you have to send another request once the page is loaded
@Meredith yea, my mistake.
but that isn't a discredit to local. in a lot of situations the template is already loaded
so using xhr/fetch to pull in the cart info isn't a terrible solution
But really though he's trying to implement some sort of auth without having to store usernames/passwords
I fear I'm about to reveal how little I understand, but it seems like there is nothing a cookie can do that can't be done with a combination of local storage and jQuery
00:46
A cookie is probably the best idea
@JonathonPhilipChambers lets step back a bit. how does it work now? in theory at least
in your mind
The ultimate point is users are reluctant to sign up for things, but I want their money anyway.
lol, the ultimate goal
Okay, cookies and php seem to go well together. They are designed for each other. Cookies and java seem hacky at best
so you want to store a local cart information. items? yea? and when they hit submit you want that info?
00:48
@JonathonPhilipChambers Java handles cookies just fine
So, I can do lots of stuff with cookies from the php end of things
PHP is designed to be tightly coupled to a bunch of things, this is good for beginners, not necessarily good for more advanced applications
It handles them fine, but a lot of the functions need to be user defined and the code looks ugly
For example, PHP has first class support for $_SESSION as well
@JonathonPhilipChambers Ha, you've just described Java in general.
cookies work really well when you want to persist a session. localStorage works really well when you want to store user information on their pc for the next visit / session
so if you have no login. I don't see why you need to store it in the cookies
you just need it on submit
Rob
Rob
00:49
@JonathonPhilipChambers There is... As I mentioned above, you can mark a cookie as HTTP only. On the other hand, using cookies makes you more vulnerable to CSRF attacks. The differences between approaches are not that large, both have potential security impacts
@rlemon A thing that many people forget is the existence of sessionStorage, the browser knows when a session ends much better than the server.
@MadaraUchiha ohh sure, but it's still local
Yup, but if you're storing session info on the client, I'd do it there and not on localStorage :)
I've turned this in my mind from cookies / localStorage to just cookies / local
00:50
it's just cart items
it's no big deal
Another thing I've done is with every key stroke and every click, the cart is sent, in full, to the server.
There's a thing to be said about business requirements and storing this information on the server
Don't do that
So, when the session begins, the first thing it does is look for your cart and load it if applicable
For example, sending an email to customers who have long standing items in their carts is relatively standard practice
@JonathonPhilipChambers You shouldn't do that
00:52
Meredith, is your objection performance or security based?
so you have an id stored in a cookie. do you render the template before hand? or do you load it with 'ajax'
@JonathonPhilipChambers Assume that there would be users that pay by the megabyte.
I mean it's just a ridiculous amount of data to send
Sending this much traffic literally costs them money.
Pay for traffic, that is.
The size of even a very large cart is less than a kb
00:53
@JonathonPhilipChambers But you send it dozens, if not hundreds of times.
if you answer my question, this is all moot
we can just set you on the right track
what's you goal. to render this server side or local
Sorry, could you dumb down your question a little?
I do use ajax
but I'm not sure if I use it the way you mean
okay, then you can do this all in localStorage. just keep an id of the cart there.
@JonathonPhilipChambers Do you know the difference between server-side and client-side rendering?
when the page loads, send that to the server
no need to track anything else.
00:54
yes, NOTHING else is stored locally
yea, so if you load then page, then with js use ajax to load the cart content, you can do this all in localStorage
okay, not entirely true. But nothing that wouldn't be deleted when you click "refresh" is stored locally
true
the user has to clear it
which is not something normal people do
but if someone is clearing localStorage, they're probably clearing cookies.
A lot of JS variables are created, which need to reload every time the user navigates to a new page
that's a session
00:57
okay, with you then
there are local apis for that as well
so, lots of session storage
or a mix
also you can do temp sessions on the server as well. this is all up to you
but local is (imo) an easier start
But really though it doesn't matter
Right now, at this point in development, the two are identical
I'm just afraid of having to remove all the local storage to get cookies back because my new website system doesn't agree with it
00:59
if all you care about on the server is getting the /whaterver/cartoutput page, I think doing it local might be easier?
assuming no login ofc.
Yes, but login is coming
Just use cookies
I want to make sure I do it right. A password leak could be the kiss of death for a business
this started because he's having problems with cookies
not because they're easy
Just let it expire after a week or a month or whatever
01:01
"having problems with cookies" is overstating it. I just wanted to know how to set the longest possible expiry.
Yeah don't bother with that
Because my server is set to store the cart indefinitely, so might as well allow the user to access it indefinitely.
Since it's there, may as well
It's very rare for a cookie to last longer than a year
anyway, I got some to expire in the year 9999, and it seems to have browser support with all my testing so far
It's not that I need the long expiry. It's just that I see no practical value in expiry
use noauth and tie it to an email
this solves the password-breach problem and the other problem =D
01:06
Usually you want sessions to expire at some point
Usually, but not this time
(yes this time)
@jake that is a funny url
kinda think they should left off the https://
Okay Meredith, I'll hear you out. Go.
I mean imagine if you left your browser window open at the library
01:09
@JonathonPhilipChambers I would say make 2 cookies
one reasonable date one in the forever future
should cover all use cases
Okay, I'll have this in the context of my website. I am a seller of spinning fibre, for spinning wheels. So I'm imagining some old lady goes to the library and decides to order some for her spinning wheel. But just before she goes to pay, she dies or something.

Then, ten years later, someone else goes to that very same computer, and decides they also want to order some spinning fibre. But much to their disappointment, they discover that their cart already has spinning fibre in it, so they have to click the "clear cart" button before continuing.
@JonathonPhilipChambers I'm willing to bet your site will be either dead in 5 years or rewriten with CSS 8 and HTML 8
That's the worst case scenario I can imagine. Or have I missed something?
also backend
Exactly William, so why bother?
01:13
You've completely missed the point
Alternatively, you forget to sign out, go to the website and find out your asshole neighbour really wants spinning wire, so you keep an eye out and steal the box when it finally arrives >:)
Once the order is placed, the cart clears
I actually prefer to make cookies expire soon as possible so useless data isn't set to the server and stored on their computer
Ah, but he finishes the order at home!
So this is only an issue for orders not placed
01:14
They still have access to the session
They could just create a new cart with the session
why does my grid area stretch? i have a grid with "1fr 1fr" so both child div's should take up 50% of the view port height. but by giving a child div a lot of text, it makes the parent div take up more than 50% of the grid container
https://codepen.io/alexbollbach/pen/ajExNO
If he's not a web developer, he likely created a new cart when he got home
You'd have to use a developer tool to access a cart from another computer
he did create a new cart, but the old one still exists at the library
actually, the old id still exists at the library, and only of the incomplete order
01:17
You're confusing two issues
Using the cart id as a session id is a bad idea for a million reasons
Having a non-expiring session key is a bad idea because someone might leave an active session up on a public device
@Meredith if no personal data is stored its a mute point
your cart isn't well very important
credit card info yes
You still don't want anyone to be able to add anything to your cart
user1596138
All that might happen is they buy more from you than they wanted. Which sounds ideal
Eventually I want a login system with all the security attached, but this cart id system is only for users that want to purchase anonymously.
^ that is what I assumed
yes no account linkage
user1596138
01:19
If these are guest carts it's not your cart anymore. If these are account level you should be clearing this at auth anyway
@JonathonPhilipChambers I would store the items in the cookie entirely and ignore the database
user1596138
sessionStorage
user1596138
Who stores data in a cookie in 2018
Correct, a rogue hacker could go into the developer tools of a victim's browser, get the cart id, travel to a remote location, and change their order slightly, only to confuse them when they reach checkout. This is a calculated risk I am aware of and have gone into knowingly.
user1596138
LOL
01:21
Or call DELETE /cart/:id on every id
hacker newsn uses cookies
google uses cookies
true, they could delete everyone's cart, forcing everyone to begin their order again.
Seems annoying
user1596138
Are the cart IDs simple
Store the actual items in the cookie
So far they are. I need to make sure there are no duplicates
01:22
use the cookie as a database
no altering anyting then
no session no localstorage
user1596138
If you use a guid that will be one hell of a dos deleting every cart item
The cookie size is too small. I sell many items by the gram
user1596138
@William why do you suggest a cookie
Having someone order 25 grams of 150 different products is probably going to happen eventually
user1596138
...your site sells by the g?
01:23
same reason I still use tables for layout on my personal sites
Such an order would break the cookie's maximum size
user1596138
sessionStorage makes perfect sense or localStorage, they are JSON
user1596138
They have a very large max size in this context
cookies are a flat system
user1596138
sessionStorage is cleared when the browser is closed if you want that
01:24
no possibility of making it unflat perio
user1596138
So is sessionStorage
25 grams is a valid order for spinning fibre, as is 26, but 24 or lower will return an error as we do not sell that small
user1596138
It's all just strings lol
user1596138
@William you know what I'm talking about right..?
I don't want it cleared. I want that cart and that device to be paired with no expiry
01:25
I guess but lynax won't support it
I like my websites working without javascript enabled
user1596138
user1596138
He probably would like to store the actual structure of the cart config
cookies work in everything since heck IE6
user1596138
That way it is as simple as updating the config object and localStorage at the same time. But sure, he could also do it with cookies if it was tiny
maybe later
I hate requiring javascript but okay
user1596138
01:26
Do you know where you are
I am here for node.js
don't know why you are here
user1596138
And outdated practices ;P
An added benefit of storing the actual data server side, is it's easier to monitor. I can later add features to see if there are items that get almost purchased a lot.
user1596138
Nobody asked why anyone was here
user1596138
Well and you may add accounts some day
01:27
I am in the node.js JavaScript room
user1596138
What's the room ID for that room
room 17
front end sucks
Anyway, for now, I'm going to keep my expire in 9999 cookies. If I run into trouble, I can always swap it out for local storage later.
smart cookie
01:28
Please just change it to like a week
and don't use a guessable id
@William The 90s called, they asked for their best practices back
The guessable id, I may change just before launch. I agree with you on that one. But I'm going to keep my long expiry cookies.
To be honest, it really depends on what you're doing
If you're a news site, you should be able to work without JavaScript
I love browsing hacker newns without javascript and everything working
even use lynx
those days are gone
Rob
Rob
@MadaraUchiha But then how would you display an obnoxious paywall when someone scrolls?
01:30
But really though
If you dont wanna use js
Just use curl
my schools class registration system was made in the 90s
@Meredith Why? Chrome works perfectly well for JSless browsing
I don't mean to offend you with my cookies. You can set your cookies to any expiry time you like. I have spent quite a bit of time trying to understand why the costs of long expiry outweigh the benefits, and I'm still not convinced that it's applicable to my website.
I do it on several extra annoying sites.
You know, when the normal condom.. er.. adblock is insufficient.
I'll give you one last chance to explain why the cost outweighs the benefit, and then I'm going to leave the chat
01:32
curl is lightweight
@Meredith ?
how do you navigate
just send another request
@Meredith to honest I have actually done something like that but at minimum you need to pipe it to more
and then at that point well you should just be using lynx
Up to you but idk how to use lynx so
My wife asked me what I am doing, so I tried to explain it as best as I can.

"You know how I explained that each cart has a ticket? Well these people are telling me I should make the ticket automatically destroy itself after a week."

"Wait... is that why the cart I left for a week got deleted?"

"Yeah,"

"I lost so much work! It was my only record of what I wanted to order! I had to figure it out all over again! No! Don't do that!"
anyway, cya all
01:36
swear to god
basically curl+more+link+form support
I don't think lynx ships with ubuntu
cookies also ;)
maybe its links then
it used to
I am running lynx in cygwin on Windowns so I'm sure it works there
Oh bad idea
cygwin?
01:40
No using lynx
It supports cookies lol
I'm surprised at how well google worked in lynx
Google actually works in the original web browser
whatever it is called
I have run it on Ubuntu
Hard to beat the brevity of curl though
brevity is a term for it I guess
Because google doesn't need to really be SEO compatible they do some pretty well not typical stuf
makes them more backwards compatible also
> Command 'make' not found
God bless
did you run?
sudo apt-get install build-essential libmotif-dev libjpeg62-dev libpng12-dev x11proto-print-dev libxmu-headers libxpm-dev libxmu-dev
are you on ubuntu
it worked less time I tried it
01:52
I wasn't paying enough attention
The install failed cuz one of those deps doesnt exist anymore
hmm I don't know google it maybe
I did dw
It's going
YEAH!
Well that's a lot of errors
oh yeah ignores that if it starts you have a half working crashes 50% of the time browser
01:55
Yeah I can't get it to build
this may have been what I used look at the issues
and closed ones
I think I just trial and errored until it worked
Looks like the problem is that they're using a really old version of libpng
let me know if you get it to workbye
I need to work on something right
Nah I'm not gonna bother

« first day (2845 days earlier)      last day (2328 days later) »