title: Alternative to HTTP Cookies?
body: <p>They say Cookies are <a href="http://cafe.elharo.com/web/why-cookies-are-bad-for-you-3/" rel="noreferrer">bad</a>. I personally believe there should be a &quot;smarter&quot; way to detect the state of a user on a web app.</p>
  <p>Say, currently this is how it works in a distributed environment where xyz.com has many pools and servers (which i know of):</p>
  <ol>
  <li>User logs in xyz.com</li>
  <li>The login module of xyz.com drops a cookie on client's local machine.</li>
  <li>Now, when the client goes to Feature1 of xyz.com, the feature1 pool checks for a local cookie, if he finds it and if it has not expired then Feature1 assumes that the client is good and lets him in.</li>
  </ol>
  <p>So, feature1 blindly trusts the client due to the cookie dropped by login module.</p>
  <p>But I feel a fundamental flaw here at stage 3. What if a hacker clones a cookie and tries to do something? (which is the first obvious thing a hacker will try to do, cookie sniffing)</p>
  <p>So, is there any alternative to this? - how will web storage, flash stored objects do in future? or cookies will rule?</p>
  <p>Not looking for an obvious answer, because there are none. I am interested in different viewpoints of approaching this probem.</p>
  <p>Thanks</p>