Hacker News Reader

Comment by tptacek | Hacker News Reader

Stateful services meaning the default way every web framework has structured a web application since 2005?

Longer, if we allow “web application” to mean “anything with a login, on the web”. All those popular forums, likely also stuff like yahoo mail, even gaming services (yes, browser-based game matchmaking services existed in the 90s, Microsoft ran one, among others) probably just because anything else would have been needlessly complicated and expensive.

Amazing how using a session ID stored in a cookie was entirely possible in 2005, but is somehow out of our reach with today's hardware.

A simple session cookie does not protect against CSRF. In 2005, session IDs were generated with low quality RNGs and too few bits making them easy to guess. OWASP happened for a reason.

It’s not hard to stand up, managing state across sessions and versions of your app is hard. For example a site I use frequently the Morgan Stanley portal is stateful and you can only be logged in from a single device/tab at once.

Most websites don’t need it, and it makes things harder to manage when rolling out new versions of your services. Life got significantly easier once I moved away from stateful services.

Yeah, and life was tough back then. My services have gotten significantly easier to manage since moving away from stateful services.

Even at a new company I don’t think I’d ever want to go back to stateful sessions. I’m not close to Google or Amazon scale, and managing state was significantly harder than dealing with JWTs.

Reply on news.ycombinator.com