# Cookies

A small piece of data that servers send to web browsers to store state and maintain information across HTTP requests.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Session revocations at scale

DevFeed: [Session revocations at scale](<https://devfeed.tech/articles/session-revocations-at-scale-37933.md>)

Original publisher: [Read original article](<https://www.canva.dev/blog/engineering/session-revocations-at-scale/>)

Author: Llew Vallis

Published: 2026-07-22T00:00:01Z

Content type: article

Language: en

Sources: [Canva Engineering](<https://devfeed.tech/sources/canva-engineering.md>)

Topics: [sessions](<https://devfeed.tech/topics/sessions.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [MySQL](<https://devfeed.tech/topics/mysql.md>), [scaling](<https://devfeed.tech/topics/scaling.md>), [gateway](<https://devfeed.tech/topics/gateway.md>), [Redis](<https://devfeed.tech/topics/redis.md>), [reliability](<https://devfeed.tech/topics/reliability.md>)

Tags: [backend](<https://devfeed.tech/tags/backend.md>), [caching](<https://devfeed.tech/tags/caching.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [gateway](<https://devfeed.tech/tags/gateway.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [redis](<https://devfeed.tech/tags/redis.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [scaling](<https://devfeed.tech/tags/scaling.md>), [security](<https://devfeed.tech/tags/security.md>), [sessions](<https://devfeed.tech/tags/sessions.md>)

### AI overview

Canva describes how it manages session revocations for hundreds of millions of users. The system keeps revocations in memory for fast gateway checks, while MySQL handles refresh-time lookups; the article explains how loading the cache during deployments created database load and discusses evaluating Redis as a caching solution.

### Source excerpt

How Canva keeps hundreds of millions of user sessions fast and secure

## Third-Party Cookies, Single Sign-On, and the Limits of Browser Privacy Interventions

DevFeed: [Third-Party Cookies, Single Sign-On, and the Limits of Browser Privacy Interventions](<https://devfeed.tech/articles/misfire-26543.md>)

Original publisher: [Read original article](<https://infrequently.org/2024/07/misfire/>)

Author: Alex Russell

Published: 2024-07-30T00:00:00Z

Content type: opinion

Language: en

Sources: [Alex Russell](<https://devfeed.tech/sources/alex-russell.md>)

Topics: [Cookies](<https://devfeed.tech/topics/cookies.md>), [Web](<https://devfeed.tech/topics/web.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [W3C](<https://devfeed.tech/topics/w3c.md>), [browsers](<https://devfeed.tech/topics/browsers.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [browsers](<https://devfeed.tech/tags/browsers.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [google](<https://devfeed.tech/tags/google.md>), [identity](<https://devfeed.tech/tags/identity.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [sso](<https://devfeed.tech/tags/sso.md>), [w3c](<https://devfeed.tech/tags/w3c.md>), [web](<https://devfeed.tech/tags/web.md>), [webdev](<https://devfeed.tech/tags/webdev.md>)

### AI overview

This commentary critiques the W3C Technical Architecture Group's response to Google's decision not to imminently remove third-party cookies. It argues that the response underplays both the limited benefits of cookie removal and the unresolved effects on Single Sign-On, sign-in flows, advertising, and user tracking.

### Source excerpt

The W3C Technical Architecture Group1 is out with a blog post and an updated Finding regarding Google's recent announcement that it will not be imminently removing third-party cookies. The current TAG members are competent technologists who have a long history of nuanced advice that looks past the shouting to get at the technical bedrock of complex situations. The TAG also plays a uniquely helpful role in boiling down the guidance it issues into actionable principles that developers can easily follow. All of which makes these pronouncements seem like weak tea. To grok why, we need to walk through the threat model, look at the technology options, and try to understand the limits of technical interventions. Contents Unmasking The Problem Fire And Movement Finding A Way Forward But before that, I should stipulate my personal position on third-party cookies: they aren't great! They should be removed from browsers when replacements are good and ready, and Google's climbdown isn't helpful. That said, we have seen nothing of the hinted-at alternatives, so the jury's out on what the impact will be in practice.2 So why am I dissapointed in the TAG, given that my position is essentially what they wrote? Because it failed to acknowledge the limited and contingent upside of removing third-party cookies, or the thorny issues we're left with after they're gone. Unmasking The Problem So, what do third-party cookies do? And how do they relate to the privacy theat model? Like a lot of web technology, third-party cookies have both positive and negative uses. Owing to a historcal lack of platform-level identity APIs, they form the backbone of nearly every large Single Sign-On (SSO) system. Thankfully, replacements have been developed and are being iterated on. Unfortunately, some browsers have unilaterally removed them without developing such replacements, disrupting sign-in flows across the web, harming users and pushing businesses toward native mobile apps. That's bad, as native app

## Why Nonprofits and Public Organizations Should Reconsider Website Cookies and Tracking

DevFeed: [Why Nonprofits and Public Organizations Should Reconsider Website Cookies and Tracking](<https://devfeed.tech/articles/of-je-doet-geen-cookies-36499.md>)

Original publisher: [Read original article](<https://berthub.eu/articles/posts/of-je-doet-geen-cookies/>)

Published: 2024-05-06T19:07:14Z

Content type: opinion

Language: nl

Sources: [Bert Hubert's writings](<https://devfeed.tech/sources/bert-hubert-s-writings.md>)

Topics: [Cookies](<https://devfeed.tech/topics/cookies.md>), [Google Analytics](<https://devfeed.tech/topics/google-analytics.md>), [Internet](<https://devfeed.tech/topics/internet.md>)

Tags: [analytics](<https://devfeed.tech/tags/analytics.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [google](<https://devfeed.tech/tags/google.md>), [google-analytics](<https://devfeed.tech/tags/google-analytics.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [surveillance](<https://devfeed.tech/tags/surveillance.md>), [trackers](<https://devfeed.tech/tags/trackers.md>), [tracking](<https://devfeed.tech/tags/tracking.md>)

### AI overview

The article argues that nonprofits and public organizations often use cookies, trackers, and Google Analytics without clear evidence that the resulting statistics inform real decisions. It questions the privacy and practical value of this tracking.

### Source excerpt

We leven in rare tijden. Cookies en tracking zijn overal op internet. We worden overal gevolgd, iedere klik wordt bijgehouden. Tools als Google Analytics zijn hierbij een Faustiaanse deal: De analytics vertellen jou dingen over je gebruikers, en in ruil vertel jij Google wat diezelfde gebruikers op jouw site doen. Vreemd genoeg hebben bergen non-profit en (overheids)organisaties met goede bedoelingen ook al die cookies en trackers aanstaan op hun sites. Zo doen ze vrolijk mee aan "surveillance capitalism", ook al hoeven ze niet te leven van advertenties.

## Cookie for a Thought - How to Manage HTTP Sessions

DevFeed: [Cookie for a Thought - How to Manage HTTP Sessions](<https://devfeed.tech/articles/cookie-for-a-thought-how-to-manage-http-sessions-29701.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/http-session-best-practices/>)

Author: sakshyam.shah@goteleport.com (Sakshyam Shah)

Published: 2022-09-08T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Security](<https://devfeed.tech/topics/security.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [generate](<https://devfeed.tech/tags/generate.md>), [hashing](<https://devfeed.tech/tags/hashing.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [http](<https://devfeed.tech/tags/http.md>), [identifier](<https://devfeed.tech/tags/identifier.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [protection](<https://devfeed.tech/tags/protection.md>), [random](<https://devfeed.tech/tags/random.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>), [token](<https://devfeed.tech/tags/token.md>), [web-applications](<https://devfeed.tech/tags/web-applications.md>)

### AI overview

This article explains how HTTP sessions use cookies to persist session state and support identity-based access control. It recommends protecting session IDs against guessing, replay, and theft, including the use of cryptographically secure random values and TLS.

### Source excerpt

Exploring techniques and best practices to manage HTTP sessions.

## Cross-Origin Web Sessions

DevFeed: [Cross-Origin Web Sessions](<https://devfeed.tech/articles/cross-origin-web-sessions-29957.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/web-session-sharing-transfer/>)

Author: info@goteleport.com (Russell Jones)

Published: 2021-05-04T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [Web](<https://devfeed.tech/topics/web.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [Security](<https://devfeed.tech/topics/security.md>), [XSS](<https://devfeed.tech/topics/xss.md>)

Tags: [cookies](<https://devfeed.tech/tags/cookies.md>), [http](<https://devfeed.tech/tags/http.md>), [request](<https://devfeed.tech/tags/request.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>), [web-applications](<https://devfeed.tech/tags/web-applications.md>), [xss](<https://devfeed.tech/tags/xss.md>)

### AI overview

This article examines mechanisms for securely transferring user sessions between web applications hosted on different domains. It explains browser cookies, session tokens, domain limitations, and query parameters as one approach for cross-origin session sharing.

### Source excerpt

Russell examines the available mechanisms for securely transferring user sessions across different web applications running at different domains.

## Web Authentication at Headspace using Auth0

DevFeed: [Web Authentication at Headspace using Auth0](<https://devfeed.tech/articles/web-authentication-at-headspace-using-auth0-24572.md>)

Original publisher: [Read original article](<https://headspace.medium.com/web-authentication-at-headspace-using-auth0-f60e0e539a2c?source=rss-3da90e297190------2>)

Author: Headspace

Published: 2021-04-26T20:43:56Z

Content type: tutorial

Language: en

Sources: [Stories by Headspace on Medium](<https://devfeed.tech/sources/stories-by-headspace-on-medium.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [Auth0](<https://devfeed.tech/topics/auth0.md>), [Web](<https://devfeed.tech/topics/web.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [auth0](<https://devfeed.tech/tags/auth0.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [login](<https://devfeed.tech/tags/login.md>), [password](<https://devfeed.tech/tags/password.md>), [server](<https://devfeed.tech/tags/server.md>), [web](<https://devfeed.tech/tags/web.md>), [web-authentication](<https://devfeed.tech/tags/web-authentication.md>)

### AI overview

This article explains modern web authentication using usernames, passwords, session tokens, and browser cookies. It describes Headspace's authentication requirements across web, backend, iOS, and Android applications and explains why the company chose Auth0 as its authentication provider.

### Source excerpt

Author: Jesse Bond, Senior Software Engineer, Web Introduction: How does modern authentication work? Authentication allows users to securely log into a system and verify that they are who they say they are in subsequent requests. On today's web, this usually involves creating an account using a combination of username and password. Let's start with a quick refresher on how modern web authentication works. The first step is always a user submitting their login credentials into a form. Once the form is submitted, the server will determine whether or not the username and password match that of a previously registered user. If they do match, the server will return what is known as a session token. A session token is a unique identifier that authenticates requests as coming from the same user that just logged in. It's important to note that session tokens usually are temporary and have an expiration, which is determined by the server. Now that the user has a session token, each request will need to submit the session token to ensure authentication. It might sound tedious to have to submit the session token on each request, but have no fear, the cookie is here! Cookies are small bits of information that the browser stores for a domain. Cookies are also automatically submitted when a request is sent by the browser. Does this sound like a great way to handle the session token or what? Correct! Session tokens are almost always stored in a browser cookie to make authenticating requests a breeze. Authentication requirements Headspace has a large number of Single Page Apps, backend services, websites, and iOS and Android applications. We needed a robust solution for authentication that met the following requirements: Multiple platform and language support Scalable to millions of users Reliable with high uptime Ability to separate our users into different groups with varying permissions (i.e., admins vs. standard users) Ability to restrict user access to certain applications. Fo

## CSRF Attacks: Examples and Mitigations

DevFeed: [CSRF Attacks: Examples and Mitigations](<https://devfeed.tech/articles/what-is-a-csrf-attack-and-what-are-the-mitigation-examples-29615.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/csrf-attacks/>)

Author: info@goteleport.com (Russell Jones)

Published: 2021-03-25T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [Exploit](<https://devfeed.tech/topics/exploit.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [HTML](<https://devfeed.tech/topics/html.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [browser](<https://devfeed.tech/tags/browser.md>), [code](<https://devfeed.tech/tags/code.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [html](<https://devfeed.tech/tags/html.md>), [http](<https://devfeed.tech/tags/http.md>), [xss](<https://devfeed.tech/tags/xss.md>)

### AI overview

This tutorial explains how Cross-Site Request Forgery (CSRF) attacks use browsers, HTML elements, cookies, and ambient credentials to submit requests as a logged-in user. It presents examples of state-changing requests and discusses their security impact and mitigations.

### Source excerpt

Understanding Cross-Site Request Forgery (CSRF) and its Mitigations.

## Preventing XSS Attacks

DevFeed: [Preventing XSS Attacks](<https://devfeed.tech/articles/preventing-xss-attacks-29979.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/xss-attacks/>)

Author: info@goteleport.com (Russell Jones)

Published: 2021-02-23T00:00:00Z

Content type: article

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [XSS](<https://devfeed.tech/topics/xss.md>), [Security](<https://devfeed.tech/topics/security.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Document Object Model (DOM)](<https://devfeed.tech/topics/dom.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [API](<https://devfeed.tech/topics/api.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [HTML](<https://devfeed.tech/topics/html.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [browser](<https://devfeed.tech/tags/browser.md>), [code](<https://devfeed.tech/tags/code.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [html](<https://devfeed.tech/tags/html.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [xss](<https://devfeed.tech/tags/xss.md>)

### AI overview

This article explains cross-site scripting (XSS), how browser security mechanisms such as the Same-Origin policy, the DOM, JavaScript, and cookies shape web isolation, and why dynamically generated sites that mix code and user-controlled data are difficult to secure. It introduces XSS attack examples and mitigation concepts.

### Source excerpt

Understanding Cross-Site Scripting (XSS) and Its Mitigations.

## Programmatically Liquidating a Steam Inventory

DevFeed: [Programmatically Liquidating a Steam Inventory](<https://devfeed.tech/articles/programatically-liquidating-my-steam-inventory-32152.md>)

Original publisher: [Read original article](<https://adambard.com/blog/programatically-liquidating-my-steam-inventory/>)

Published: 2018-05-23T00:00:00Z

Content type: tutorial

Language: en

Sources: [Adam Bard](<https://devfeed.tech/sources/adam-bard.md>)

Topics: [Script](<https://devfeed.tech/topics/script.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [code](<https://devfeed.tech/tags/code.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [github](<https://devfeed.tech/tags/github.md>), [script](<https://devfeed.tech/tags/script.md>)

### AI overview

The article documents a script that automates selling items from a Steam inventory. It describes the authentication flow, inventory and item requests, price checks, sales process, and use of persistent cookies because Steam does not provide a publicly documented API for this task.

### Source excerpt

I don't know about you, but every so often my Steam Inventory gets a bit out of control. I have no use for Don't Starve trading cards, but it's not really worth my time to individually sell each item for a few cents. However, what is worth my time, apparently, is creating a script to do it for me. This turned out to be quite a winding road, which I've documented here.

## When bureaucracy hits the web: the cookie law

DevFeed: [When bureaucracy hits the web: the cookie law](<https://devfeed.tech/articles/when-bureaucracy-hits-the-web-the-cookie-law-27107.md>)

Original publisher: [Read original article](<https://andrea.corbellini.name/2015/09/22/cookie-law/>)

Author: andreacorbellini

Published: 2015-09-22T18:35:00Z

Content type: opinion

Language: en

Sources: [Andrea Corbellini](<https://devfeed.tech/sources/andrea-corbellini.md>)

Topics: [Cookies](<https://devfeed.tech/topics/cookies.md>), [Web](<https://devfeed.tech/topics/web.md>), [Google Analytics](<https://devfeed.tech/topics/google-analytics.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [consent](<https://devfeed.tech/tags/consent.md>), [cookie-law](<https://devfeed.tech/tags/cookie-law.md>), [eu](<https://devfeed.tech/tags/eu.md>), [google-analytics](<https://devfeed.tech/tags/google-analytics.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [third-party](<https://devfeed.tech/tags/third-party.md>)

### AI overview

A personal commentary on the EU cookie law argues that compliance can require intrusive banners, privacy policies, and consent mechanisms. The author describes removing cookies and third-party features from maintained websites, while retaining Google Analytics, social sharing buttons, and Disqus on the blog under the author's stated interpretation of the rules.

### Source excerpt

For a few years now, every first of April I hoped to read between the news something on the lines of "the cookie law was a joke, sorry for that". You know, bureaucracy is slow, and it's reasonable to think that it takes time for them to reveal jokes. Yet, many firsts of April have passed, and no such announcement has been made ...