Re: Cookieless session management & authentication.

Ben Scherrey said:
> I'm curious is such a thing has been implemented under Quixote. If not,
> is there much interest in it? I have a need and some ideas of how I'd
> implement such a thing but would prefer to "buy" vs. build if possible.

I don't think this was answered yet.  I would have replied sooner but my
DSL modem has been broken for over a week so I have limited time for
e-mail.  The only cookieless strategy I know of is to embed the session ID
as a URL component.  This is possible with Quixote but I don't know of
anyone who has considered it worthwhile enough to take the time to
implement.  It messes up people's bookmarks, etc.  As session-mgmt.txt
says, "Since Quixote views the URL as a fundamental part of the web user
interface, a URL-based session management scheme is considered
un-Quixotic."  I've seen it implemented in PHP and Webware, and it seems
more error-prone (and a bunch of ugly code) than just doing cookies.  It's
getting easier nowadays to convince people that the cookie scare of the
late 90s was overblown.

-- 
-- Mike Orr <[email protected]>