Hacker News Reader

>I'm not sure why they don't use the new flow for everyone.

It's less secure, slower (more round trips), and more server side intense - likely considered a hack. Effectively it does the same what a cookie would. The 3rd party cookies are not a bad thing per se, it's just that they have been abused to hell and back, is what causes their reputation.

View on HN

I don't think it has to be. They could make the request as an ajax request with an Authorization header. Of course that makes the frontend more complex as it as to do some gymnastics to treat the response as a download.

Tried it, wouldn't recommend it. The file data would be stored in the browser tab's memory. It usually ends in crashes.

Reply on news.ycombinator.com