Suzanne Daniel Thomas

Figuring out tech, one build at a time
• Building • Learning • Documenting

[Suzanne Daniel Thomas @Suzanne__e]

You would have to write the code to store the cookie after login and manually attach it to every subsequent request, recreating by hand what a browser normally does for free.

[Suzanne Daniel Thomas @Suzanne__e]

reading more on cookies to understand that they are a browser specific mechanism. The whole system of Set-Cookie from the server, the browser automatically storing it, the browser attaching it on future requests; that automatic behavior is something browsers were built to do.

[Suzanne Daniel Thomas @Suzanne__e]

the catch is that HTTP was never built to remember anyone. every request arrives as a stranger and never changes no matter. the thing keeping you logged in is a cookie the server handed your browser once and re-sent it on every request since.

[Suzanne Daniel Thomas @Suzanne__e]

Mobile apps and non browser clients don't have this. If you're building a mobile app that calls a backend API, there's no browser sitting in the middle automatically storing and re sending cookies for you. You can still use cookies in these contexts but it gets clunky..

[Suzanne Daniel Thomas @Suzanne__e]

@laziedev @capydotai @useOrchestrator @_hyperiux_ ik kiki now without even meeting her..crazy page!

[Suzanne Daniel Thomas @Suzanne__e]

another way JWTs show up is no cookie at all; an api call with Authorization: Bearer eyJhbGc.. in the header. this is actually more common for JWTs in practice, especially for mobile apps and public apis, since cookies don't really work the same way outside a browser.

[Suzanne Daniel Thomas @Suzanne__e]

a set-cookie isn't the session side of this, it's just the delivery method. what actually decides session based vs JWT is the type of id sitting inside that cookie.

[Suzanne Daniel Thomas @Suzanne__e]

that cookie only proves you're logged in, it says nothing about how strong your login is once it's gone. picking the wrong one means either you can't kick out a compromised account fast enough, or you overbuilt for a problem you never had.

[Suzanne Daniel Thomas @Suzanne__e]

a random id like session_id=abc123 that the server looks up in a database, that's session based auth riding on a cookie. a full JWT sitting inside that same cookie instead, that's JWT based auth using the identical delivery mechanism. same envelope, different things it can carry.

[Suzanne Daniel Thomas @Suzanne__e]

bombolonis at the Piatto Cafe in Pune and I'm already thinking when I'm going back lol. didn't take pics but the vibe alone was worth it along with some good work done

[Suzanne Daniel Thomas @Suzanne__e]

@shreyadoesstuff facts stated

[Suzanne Daniel Thomas @Suzanne__e]

@VatsalTelang True that

[Suzanne Daniel Thomas @Suzanne__e]

morning after exams is peaceful :)
until you realise the next one is one week away..

[Suzanne Daniel Thomas @Suzanne__e]

@aryansfulari 😭

[Suzanne Daniel Thomas @Suzanne__e]

cookies, tokens, certs and otp codes all expire on a clock, and the clock is the one thing we never really think about

[Suzanne Daniel Thomas @Suzanne__e]

a token isn't valid for 15 minutes, it's valid until a timestamp, and the server reading it decides whether that timestamp has passed. a token that expires at 3:00 only works if every server agrees what 3:00 is.

[Suzanne Daniel Thomas @Suzanne__e]

@AtharvaXDevs i forgot to mention it was the malayalam one that released in July..hindi is yet to come for the 3rd sequel :)

[Suzanne Daniel Thomas @Suzanne__e]

@AtharvaXDevs 3 was already out this july :)

[Suzanne Daniel Thomas @Suzanne__e]

a token isn't valid for 15 minutes, it's valid until a timestamp, and the server reading it decides whether that timestamp has passed. a token that expires at 3:00 only works if every server agrees what 3:00 is.

[Suzanne Daniel Thomas @Suzanne__e]

@ruchirajags 🙌🏼🫂

[Suzanne Daniel Thomas @Suzanne__e]

that cookie only proves you're logged in, it says nothing about how strong your login is once it's gone. picking the wrong one means either you can't kick out a compromised account fast enough, or you overbuilt for a problem you never had.

[Suzanne Daniel Thomas @Suzanne__e]

the catch is that HTTP was never built to remember anyone. every request arrives as a stranger and never changes no matter. the thing keeping you logged in is a cookie the server handed your browser once and re-sent it on every request since.

[Suzanne Daniel Thomas @Suzanne__e]

@arsh_goyal @Kimi_Moonshot Pune

[Suzanne Daniel Thomas @Suzanne__e]

first one's session based, the server keeps an actual record of your login so deleting that row logs you out right away. second is JWT based, the token carries your identity inside itself and the server just checks a signature, nothing to delete on its end.

[Suzanne Daniel Thomas @Suzanne__e]

picture two apps that both promise 'you'll stay logged in.' one kills your access instantly the moment something looks off. the other can't touch it until the token expires hours later, no matter what anyone notices in the meantime.