Congratulations, you just broke nearly every website out there. This would trigger bot detection all over the place.

This also means that on load the first thing that will happen is an AJAX POST in the background, or the moment you press the mouse on anything on the page in case that gets further restricted.

What? I browse without cookies (even first-party), and apart from the WE USE COOKIES banner that ironically can't be acknowledged most sites work just fine.

Obviously shopping sites and similar get whitelisted.

If you don't interact with sites (POSTing, like the parent comment is talking about) you obviously won't notice the breakage. Since you whitelist the sites you interact with (shopping sites and similar) you are already sidestepping the problem.

POST requests work perfectly fine without cookies.

Edit: I just saw your comment in the sibling thread. Guess I won't be interacting with your sites any time soon.

(brb updating my bots and scrapers to use cookies)

No shit. It's the actual server side implementation that will be like, "The fuck you doing?". Because you'll be breaking the web.

My proposal doesn't break anything. If site authors change things users will probably react against the sites. Currently browsing with cookies disabled works fine almost everywhere.

Moreover, a browser can easily differentiate an AJAX POST from a user submitting a form.

Except that most webapps are entirely javascript based and thus AJAX nowadays. But I guess we're just conveniently ignoring this?

And I'm not talking about changing anything. On most of my websites if you do a POST without having a session id (which gets assigned on first pageload, a GET), then you are a bot and your POST will be blocked. Byebye. There are many such schemes out there.

I wish the libraries I use to make sites made it easy to only send cookies after logging in, as opposed to before.