DEV Community

Discussion on: What is really the difference between Cookie, Session and Tokens that nobody is talking about ?.

jcubic profile image
Jakub T. Jankiewicz

I think you don't u understand what I just wrote and keep changing the subject. First, you said that you can't use the database which is not true because you can use it for the session if you create your own mechanism.

Then you're contradicting yourself because first, you said that you can't have a session without cookies, and then next you said that you can use the GET parameter for the session_ID.

My comment only meant that you can create the session with a database and without cookies. You don't need to rely on whatever the platform gives you.

Thread Thread
andreidascalu profile image
Andrei Dascalu

No man, what I'm talking about is the context of the OP: cookies vs sessions vs tokens, used as means of exchanging information that stores information about user activity. These terms were used under their proper definition (including session, as a server-provided ephemeral storage).
Yeah, sure, you can create your custom system, you can create your custom anything but what I was talking is what you can use to integrate within the sever provided framework (which already manages how clients are identified and whatnot). That's way beyond the topic of using what's provided. My point was merely to correct a statement in the OP which implied that databases are somehow part of the session mechanism (they're not). The session mechanism as per OP is what the server provides you. You could create your own, but that's not the same thing.
Also, the mere fact that something exists doesn't mean it's usable (session id in URL is as exposed as you can get) so I wouldn't consider as something that's in your toolbox.

Thread Thread
kevinmduffey profile image
Kevin Duffey

Andrei is correct.. Jakub seems to miss Andrei's point.