News for hackers. Stuff that matters.
Re:A practical proposal for migrating to safe long sessions ... by sesm on Thursday July 21, 2016 @05:11PM (#12140106)
I second your question. The only downside of sending both cookies on each request is a bigger request size, which is not a bad trade-off for much simpler client (no service workers, everything is managed by cookie jar)

Also, the approach with 2 cookies (statefull + stateless) is known for a long time. Eran Hammer (author of OAuth1 and OAuth2 specs) wrote about using this approach at Yahoo here: https://sideway.com/room/4Z (search for Yahoo).

There are no comments on this comment yet.