[andybak]

Cookie based session logins like everyone used to use?

[embik]

Not everyone can look back at a 10 year long career in the industry to draw inspiration from. Especially for junior engineers, pointing out alternatives (that feel obvious to you) would be important.

[sleepyhead]

Can’t be used when embedding on third party sites though.

[sam_lowry_]

I work for ab EU government, and cookies are a no-go because of cookies directive, so we use JWT and auth the javscript engine, not the browser.

This leads to a multitude if problems, but who cares?

[andybak]

This makes no sense. The law didn't specify cookies specifically, it is agnostic about the technical implemention, surely?

Is this a clueless manager thing?

[sam_lowry_]

Not a manager thing, it is a consensus in at least one major EU government sweatshop.

Go figure.

[tester756]

>and cookies are a no-go because of cookies directive

haha, what?!

this is not true.

[uxp8u61q]

That's bullshit. Even ec.europa.eu (the European Commission's website - I have to login there from time to time) sets session cookies on my browsers. Either you've misunderstood what's asked of you, or your manager has, or someone higher up in your organization. But the "cookie directive" has never prevented anyone from using cookies altogether. You don't even need to ask for consent for a session cookie.

[sam_lowry_]

*.europa.eu websites have been known to infringe on EU rules forever. Shoemaker without shoes, you know.

[uxp8u61q]

That's a bold claim, any source?