Forum Moderators: coopster & phranque

Message Too Old, No Replies

False "cookies"

Is this legal?

         

adni18

12:36 pm on Nov 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Is it legal to store false cookies on the server, by using the:

open(COOKIE,"$ENV{'REMOTE_ADDR'}.txt");
print "data stuff";
close COOKIE;

script? I am concerned about the client not allowing cookies to be used. The cookies do not store any private data, just whether they are logged in or not.

Dreamquick

1:11 pm on Nov 4, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



That sounds like a session management system which doesn't require the user to be accepting cookies for it to work, which wouldn't be illegal in itself.

However two things to think about;

1. IP address alone isn't a good way to uniquely identify distinct users within a session, especially for proxy/NAT connections and AOL customers.

This has the potential to show the contents of one person's cookies to someone else, which can make the affected people wary of using your site and/or mess up your tracking.

There may also be legal implications if you were using that cookie to tie personal information to a user - no one likes to log on and randomly be given the name, address and credit card information for some unsuspecting little lady down the road (aside from tabloid reporters after a cheap story).

2. Just storing pseudo-cookies doesn't give you any built-in garbage clean-up method, which means that;

a. if I log on today, and you log on tomorrow and we both happen to have the same IP (same ISP?) I'll get your cookie.

b. you're going to have a lot of junk laying about on your disk, and the longer you keep them around the greater the the chances of whatever unique key you used to name those cookies being "recycled".

- Tony